Devbox v2.0.2

Security hardening for v2.

• Record a verified identity for each golden and refuse goldens without one.
• Bind kept boxes to their project directory; devbox adopt NAME DIR claims a box created by an earlier version.
• Issue GitHub and traffic-audit capabilities per box and generation, and revoke them when a box loses the grant.
• Enforce audited egress with an nftables policy installed at boot.
• Refuse writable mounts that contain the home directory, or contain or lie inside Devbox state.
• Refuse mounts and grant sources beneath another Lima instance's writable mount, including instances not created by Devbox.
• Snapshot host grant sources through file descriptors, resolved once.
• Cap proxy connections, per-box requests and per-box tunnels.
• Write AI-proxy audit records to their own log, store request bodies once, and move an oversized legacy log aside instead of truncating it.
• Refuse proxy capability keys that are symlinks, short, or readable by others.
• Stop restarting a running kept box on re-entry unless SSH-agent forwarding must be removed.
• Stop copying stado configuration with --with-agent-config.
• Include --keep and a custom box name in the --keep re-enter hint.
• Pin the Homebrew bootstrap and the site-version workflow to reviewed revisions.

Upgrade with brew upgrade foobarto/tap/devbox, then:

• rebuild goldens with devbox build --force (devbox destroy --goldens removes old ones);
• run devbox adopt NAME DIR once for each kept box created by an earlier version;
• re-enter running boxes so they receive new capabilities;
• chmod 600 the api-keys file and keep it to plain KEY=value lines;
• recreate stopped boxes that use audited egress;
• in a clone of this repository, rerun make hooks.

Validation: 189 Bats and 185 Python tests and ShellCheck passed. On real Debian 12 guests, audited egress held across a guest restart. Re-entering a running kept box kept it up. Legacy goldens and unadopted boxes were refused. A grant source inside another VM's writable mount was refused.