Styx v0.2.0 — the wishlist crossing

The wishlist release: everything the first external integration of the shared-memory transport — a device gateway embedding Styx as its device-plugin transport — had to work around, closed. Six public-API additions, four fixes the work surfaced, every feature commit externally reviewed to a clean verdict before landing.

Stability: pre-1.0 — the public Go API may still move between minor versions. The wire contracts (shm-abi.md, stream-protocol.md) are frozen and change only by explicit, versioned amendment.

Added

• ErrPayloadTooLarge — an oversize payload is rejected before any byte is published, and that rejection is now errors.Is-matchable at the public API on unary calls, stream opens, and stream sends. A host's error-translation table can classify it instead of default-denying a deterministic condition.
• Live stdio observation — PluginSpec.Stdio takes a StdioSink receiving every stdout/stderr line a plugin writes, live; a slow or panicking sink never blocks or crashes the plugin. PluginCrashError.StderrTail carries the crash tail structured, so log pipelines stop parsing it out of Reason.
• Host.Health(name) — a pull-based, level-triggered health snapshot: most recent lifecycle state, last transition time, last error, and the current consecutive missed-heartbeat count. Built for synchronous probes (a Kubernetes liveness handler, an embedding supervisor's Ping()) that previously had to rebuild retained state from the edge-triggered Events() channel. Unknown names answer ErrUnknownPlugin.
• Protobuf editions support in protoc-gen-go-styx — edition = "2023" contract files generate; the declared range mirrors the pinned protobuf runtime, with golden and response-contract tests keeping it honest.
• NoRestart — a named supervision policy for hosts whose embedding supervisor owns restart decisions, plus the documented host-owned-restart pattern (fresh Host per recreation) in docs/plugin-lifecycle.md.
• IncompatibleError.Kind — a tampered or wrong binary on disk (IncompatibleBinaryIdentity) is now distinguishable from ordinary version skew (IncompatibleHandshake) without parsing Reason.

Fixed

• An oversize STREAM_OPEN surfaced wrapped in the retryable ErrPluginUnavailable, mislabeling a deterministic rejection as transient.
• The shared-memory writer's arena oversize backstop reported an error outside the never-published classification, which would have misclassified a provably-unpublished send as outcome-unknown.
• Host.Start silently attached a second supervisor to an already-started name, overwriting its routing; it now refuses with ErrPluginAlreadyStarted.
• make lint never linted the failpoint-tagged files that make test-failpoint tests; the ci gate now runs both passes.

Full details in CHANGELOG.md.