runtime 1.2.2

Runtime 1.2.2 upgrade

Runtime's Doctor and kernel-cache now select the same generation as Kernel
1.1.4, including its durable private per-user fallback. When the optional Kernel
is installed, Composer requires 1.1.4 or newer. Plain WordPress installations
remain supported without Kernel.
Doctor marks unused kernel cache/build directories and their permissions as
not-applicable when Kernel is absent, including plain WordPress installed directly
in the project root. Unused cache overrides do not cause diagnostic failures.

An unsafe explicit APP_CACHE_DIR fails instead of producing a passing diagnostic
or silently selecting another directory. Implicit fallback selection appears as
kernel.cache-migration; Doctor does not create or migrate anything. A missing
selected cache remains unknown until it is warmed. Previously unsafe implicit
generations remain untouched and must not be reused.

For an external deployment cache, provision an absolute APP_CACHE_DIR and
optional APP_BUILD_DIR outside the webroot. Each root must already exist with
mode 0700 and belong to the PHP-FPM user. Run diagnostics, explicit maintenance
and warmup as that same identity. Symlinks in roots or ancestors, parent traversal,
foreign directory owners and group/world writable directories are rejected before
any deletion. External ancestors must be protected, belong to the calling user or
the system root user, and have the sticky bit if shared writable. Only the selected
environment's kernel directory is cleared;
other environments and sibling asset caches are preserved.

Standalone checks also reject known WordPress core/content and conventional
public cache locations without loading WordPress. Declare a custom server root
with doctor --webroot; Runtime does not inspect the web server configuration.

Doctor checks the calling identity and filesystem namespace. Its readable cache
check does not prove complete warmup or access from a different PHP-FPM UID or
service namespace. Validate the deployed web process separately before traffic
switches. Generic Runtime artifact writes remain confined to the release project.

Validation includes a real Kernel 1.1.4 compiled container, safe external cache and
build roots, fallback warning and read-only diagnostics, unsafe-root failure before
deletion, and preservation of other environments and assets. Hosted release and
consumer acceptance are separate checks.