v0.11.0: Full DokiLink Mesh, macOS VZ cgo, K8s 100%, Podman wiring

v0.11.0 — Full DokiLink Mesh, macOS VZ, K8s 100%, Podman Wiring

DokiLink Mesh

• NAT traversal: STUN client, TCP hole punching, TURN-like relay
• DHT: Kademlia 160-bit, k=8, alpha=3 — peers discover without static config
• mDNS 90s expiry: now actually implemented with cleanup loop
• Crypto fixes: order-independent DeriveSecretKey, nonce seeded per-connection, replay protection

macOS Native Virtualization

• VZ backend with cgo+ObjC: real Virtualization.framework bridge
• Build tags fixed: compiles on all platforms
• QEMU/Sandbox backends: mutex, timeout, arch-aware, tightened profile

Kubernetes 100%

• CRI gRPC: 35+6 RPCs, Unix socket, real container lifecycle
• Kubelet: real CRI integration, PodIP from PodSandboxStatus
• Kube-proxy: real iptables/nftables/userspace proxy
• Controllers: Job/Endpoint/Service/Namespace/GarbageCollector
• API server: PATCH, Watch format, metadata generation, group paths
• SQLiteStore: persistent state
• Scheduler/CoreDNS: real scoring, SRV records, NXDOMAIN

Podman Wiring

• Shim mounted in dokid (was dead code)
• System info from runtime detection
• Container lifecycle delegates to PodManager

Dependencies

• Version hygiene across all components
• Compose healthcheck execution (service_healthy works)
• doki deps tool: ls/check/go/install

Security

• Path traversal guards, constant-time comparison, mTLS, replay protection, OOM DoS prevention
• 8741 insertions, 2151 deletions, 8 new files, 165 files changed