Vitrallis Shell 0.1.0-beta4 — shared Arti Tor service

Adds Arti as one shared, Shell-managed Tor service. Arti remains a separate executable/process and is never embedded into the Shell runtime.

• On-demand startup by default, plus Always on and Disabled modes.
• Settings → Device → Wireless → Tor: status, bootstrap, app count, startup mode, start/stop/restart and diagnostics, usable with keyboard and touch at 480×272.
• App manifests support network.tor = "required", "preferred" or "none".
• Required apps wait for Tor and use Linux network isolation to prevent accidental clearnet fallback. One loopback SOCKS endpoint serves all apps.
• Bounded supervision/retries, private state, no idle Arti process, and standalone Arti 2.6.0 provisioning in the full v2 bundle.

Updating without reinstalling

From beta3.9: Check, Install and Relaunch once to install the full beta4 bundle.

From an older managed Shell: Check, Install and Relaunch to enter beta4, then repeat Check, Install and Relaunch once. The second check says Complete this release: 0.1.0-beta4 and adds Arti through the verified five-executable v2 bundle. Existing apps continue working during this transition; required Tor apps fail closed until completion. A complete beta4 installation reports up to date.

Both routes preserve app/wallet data and configuration and retain the previous binary generation. New installations use the full v2 bundle directly. See upgrade details.

Required-app isolation needs Bubblewrap and unprivileged Linux namespaces. Fresh PocketCHIP bootstrap installs Bubblewrap; OTA does not silently run root package operations. Systems missing it report the prerequisite and fail closed. This protects against accidental direct connections, not hostile same-user applications. Connected means bootstrapped local proxy readiness, not guaranteed reachability of every destination.

Validation: formatting, strict Clippy, full Rust/Python suites, Linux CI on Rust 1.91.0 and 1.91.1, simulator, uploaded checksums/inventories, real release-bundle update transactions, and isolated PocketCHIP tests for both the beta3.9 bridge and skipped-bridge route. Tor device validation passed all 15 tests, including real bootstrap, repeated restarts, direct IPv4/IPv6/DNS blocking and 480×272 UI checks. Release transaction tests used temporary installations; they did not replace the installed configuration or apps.

Assets: 20 files. Each architecture has a complete five-executable -v2.vtrbundle, a four-executable OTA entry-point bundle, and their SHA-256 sidecars. Matching ARM installer/session helpers are included. Requires glibc 2.36+ and SDL2 2.26.5+.

Release build and native/ARM verification: successful workflow.