Per-host Subnet v0.2.8

Linux/amd64 companion binary rebuilt from verified source commit f6bd5ad with Go 1.27.0. The CI raw asset matches the archive byte-for-byte; SHA256SUMS and CycloneDX SBOM are attached. Binary-mode govulncheck found no vulnerabilities; Trivy 0.74.0 rootfs recognized the Go binary and stdlib v1.27.0 with zero vulnerability and secret findings. This is a Linux integration prerelease. Privileged two-host, Windows, upgrade, and rollback validation remain outstanding; do not treat this asset alone as a production approval.