v0.2.7

v0.2.7 — the release carries its payload

ADR-200. Until now the signed binary was a release but the files it put on a host — the nightly-maintenance script, the posture and observability units, the Grafana templates and dashboards — were read at run time from whatever --repo pointed at: any commit, any branch, a hand-edited tree. deploy-updates --apply from a checkout could ship a script no release ever contained. It cannot now. Every file a deploy-* command installs is embedded in the binary at build time, so the only way a script reaches a hypervisor is inside a signed release.

Changed

• payload.rs — all 29 shipped files (hypervisor-update.sh, hypervisor-uncordon.sh, notify.sh, grafana-health.sh, substrate-reconcile.sh, four update units, four posture units, nine observability units, the Grafana and Traefik templates, provisioning, three dashboards) are include_bytes! in an explicit list. No build script walks a directory: a test walks systemd/ and observability-host/ and fails when a file is on disk but not listed, or listed but gone. The three auto-roll units are recorded as deliberately unshipped (ADR-186) with the reason beside them.
• deploy-updates, deploy-posture and deploy-observability read only the payload. --repo supplies site.yml and versions.yml and nothing else — /etc/substrate on a host is a complete repo. Dashboards are enumerated from the payload, not from a directory at deploy time.
• Every deploy opens with payload: substrate 0.2.7 (v0.2.7) — every file below is this release's, not the checkout's.
• release.yaml lints every shipped script with the same shellcheck the test workflow runs. v0.2.6's commit was red on test and green on release (bug-175); one commit now gets one verdict.

Fixed

• bug-175 — SC2086 in hypervisor-update.sh (peer count). Rides in this release, which is now the only way a script fix ships.
• bug-176 — a deploy could install a script from the working tree. Closed by construction: the working tree is no longer an input.

Operator notes

• install.sh v0.2.7 on each host. Then, once, from the host that reaches the others: substrate deploy-updates --apply — the first apply that writes PEER_HOSTS= (v0.2.6 introduced the list; this is the release that installs the script honouring it) — and substrate deploy-posture --apply. Both fan out to every hypervisor in site.yml.
• A change to any shipped script or unit is a release from here on. There is no other path.

161 tests.