v0.1.1

Adds a public, atomic first-adoption bootstrap that seeds the current trusted executable as K's stable rollback target before the first service transaction. Also exports K's canonical slot path resolver. Includes fail-closed partial-state checks and a real first-upgrade rollback tooth.