v0.0.31

Changelog

• 3cf9417 Merge pull request #68 from cruxdigital-llc/plan/managed-host-migration-hardening
• 0fc163f docs(spec): record PR #68 review fixes + zach live-migration validation
• 84b87a3 fix(managedhost): address PR #68 review (4 findings)
• 81af30b feat(managedhost): migration hardening — proxy pin, fail-safe reconcile, refresh-all timeout, pre-start flock (R1-R4)
• e679819 docs(spec): managed-host migration hardening (reboot/restart safety) — plan + spec
• 1b41c12 Merge pull request #67 from cruxdigital-llc/plan/managed-host-provisioning-engine
• b8c32a0 fix(managedhost): address PR #67 review — migration rule flush, bounded restart, routing reconcile on remove
• 55439c1 feat(infra): slim periodic integrity check — drop reserved-key jq (now preventive) (slices 4+3, B5)
• f2dd6cf feat(managedhost): Go systemd engine replaces bash unit-gen on AWS (slices 4+3, increment B)
• 914004d feat(managedhost): host-supervisor engine core + deterministic network + reserved-key guard (slices 4+3, increment A)
• 0d74dec feat(awsprovider): provision scripts are infra-only; RefreshAgent owns config+start (slice 2b)
• 422c96c docs(spec): record fresh-provision live verification (throwaway slice2test)
• ff0ddf9 docs(spec): record live verification of slices 1+2a+opus-4.8 on aaron
• 86abde9 feat(awsprovider): make Go-generated config authoritative on first provision (slice 2a)
• 9f21cf0 docs(spec): ground slice 2 (provision-flow reorder) + record opus-4.8 bump
• 4b488c2 chore(config): default fleet model to opus 4.8
• 01b9d98 feat(awsprovider): route provisioning routing.json through managed-host engine (slice 1)
• 78687a8 docs(spec): managed-host provisioning engine (plan + spec)
• 542998d behavior(team): default team agents to silence in shared channels (#66)
• 3c67ee7 chore(terraform): pin conga provider to v0.1.8 (#65)