v3.2.2

What's Changed

• feat(runtime): enforce service lifecycle contract by @ZhiXiao-Lin in #217
• test(runtime): harden R17 lifecycle conformance by @ZhiXiao-Lin in #218
• fix(runtime): wait for private OCI socket mode by @ZhiXiao-Lin in #219
• fix(runtime): finalize exited OCI providers by @ZhiXiao-Lin in #220
• fix(runtime): preflight OCI isolation before image mutation by @ZhiXiao-Lin in #221
• fix(snapshot): gate raw ext4 restore identity to macOS by @ZhiXiao-Lin in #222
• test(sandbox): gate installed product without KVM by @ZhiXiao-Lin in #223
• fix(ci): make the installed OCI product gate deterministic by @ZhiXiao-Lin in #225
• feat(runtime): persist OCI anonymous volume ownership by @ZhiXiao-Lin in #224
• fix(build): separate Debian and GNU architecture names by @ZhiXiao-Lin in #227
• fix(macos): stabilize mutating VirtioFS traversal by @ZhiXiao-Lin in #228
• fix(build): preserve guest device and OCI identities by @ZhiXiao-Lin in #229
• fix(macos): reconcile exited shim processes by @ZhiXiao-Lin in #230
• fix(release): include declared libkrun example source by @ZhiXiao-Lin in #231
• release: publish a3s-box 3.2.1 by @ZhiXiao-Lin in #232
• fix(macos): isolate nested rustc from Homebrew LLVM by @ZhiXiao-Lin in #233
• release: prepare a3s-box 3.2.2 by @ZhiXiao-Lin in #234

Full Changelog: v3.2.0...v3.2.2