v0.33.0

Seven defects reported from the field, and seven more found while fixing them.

• kern exec works where it used to refuse, and no longer waits 25 seconds to fail inside a user namespace: a remapped uid is not a different cgroup tree.
• kern image inspect emits the labels and the healthcheck it had already parsed, both in the shapes a consumer reads.
• kern compose exec enters the box that is running instead of rebuilding every build: service first.
• kern compose start and restart print their own note, not up's.
• A half-deleted layer could still be a cache hit, and the build said built. gc and the kern top Images tab now say what they could not reclaim.
• A pull that could not be READ reported a private repository. An empty response body is what a dropped connection leaves; the cause is read from errors[].code now, the field the registry declares it in.
• kern doctor stopped contradicting itself in one row, and stopped recommending a delegation it had just reported as present.

kern-sandbox 0.2.49 carries this binary: workspace_max_bytes is overshot by far less and by an amount that depends on what the workspace costs to measure, and a file the box left at mode 0 is refused as a FILE rather than as "a directory ... not ours".

Full detail in CHANGELOG.md.

curl -fsSL https://raw.githubusercontent.com/getkern/kern/main/install.sh | sh