v1.6.0 — capacity admission, reservation-safe integration, unified cluster health

Schema v42 → v50. Forward-only: there is no downgrade path once a node has
migrated.

Capacity and quota

• Host capacity, project quota and explicit overcommit are now decided by a
  serialized reserve-then-verify admission carrying a commit fence, rather than
  read-only checks that could not see a concurrent request's in-flight claim.
• Host CPU/memory overcommit ratios and explicit reserves; container memory
  counts toward host capacity; storage-pool free space is admitted.
• Explicit overcommit is gated behind its own authorization verb.
• Project quota covers all four bounded dimensions — vCPU, memory, disk and
  NICs — on every path that lands a workload: create, clone, restore and
  import, for VMs and containers alike.
• One bytes-to-GiB rule for disk everywhere it is measured, so a charge made at
  admission is a number the accounting can observe as paid.

Cluster health

• The fragmented health APIs are replaced by one durable model.

Platform

• OTLP logging and distributed tracing.
• Darwin client builds and Homebrew packaging.
• Explicit, documented multi-homed host advertisement.

Correctness

• A host-less container operation whose name matches containers on more than
  one host is refused, naming the candidates, instead of acting on whichever
  matched first.

Upgrading

• Run the host upgrade with ALL hosts named, so the schema pre-stages
  cluster-wide before any node rolls. Upgrading a single node against older
  peers strands the majority on a schema it cannot accept.
• Running domains survive the daemon re-exec.