v2.0.0-rc.5

Features

• Added R2-backed model updates with sha256 verification, staged load validation, atomic install, and update/
  check support.
• Added signed model publishing via compat-tested .tar.zst bundles for azoth.
• Updated to cleave 2.0.0-rc.5, filefacts 0.9.5, and stng 1.6.0 for newer package, PE/CLR, archive, and string
  signals.
• Added crash-time in-flight analysis dumps to identify likely files behind stack-overflow aborts.
• Added trait-floor escalation: confident high-severity cleave findings can raise a model-benign verdict to
  suspicious.
• Added severity-fraction aggregate features for sparse high-risk finding clusters.

Performance

• Replaced git-based model and trait updates with compressed R2 bundles.
• Removed old git updater code and rollback paths; model bundles are validated before going live.
• Model publishing now reuses cleave’s manifest generator with cached compatibility validation.

Bugfixes

• Suspicious verdicts are now capped at level 20000, preventing very loose grid hits from becoming suspicious.
• Raised max CLI severity level to 25000 while keeping suspicious bounded.
• Preserves rare anti-analysis metrics like AST depth capping for model features.
• Validation output now reports level and decision threshold, making model failures easier to triage.
• Removed a temporary benign-sample validation waiver so validation reflects current model behavior.