Debuglet v0.2.0-rc.3

Changed

• Keep the HTTP API at 1.3; the rc.2 changelog incorrectly said 1.2.
• Use tc clsact when TCX is unavailable. The pure-Go fallback now tags IPv4
  UDP and ICMP with SipHash-2-4 and CAP_NET_RAW; TCP, TLS, and SCION remain
  untagged in this mode.
• Require lowercase canonical run IDs in the API, CLI, and Go client.
• Configuration-only deployments now preserve the release recorded on each
  host and reject conflicting version overrides.

Fixed

• Continue deploying other executors when one host becomes unreachable.
• Handle invalid SCION path indices and missing metadata without panicking.
• Reject expired or not-yet-valid executor client certificates at startup.
• Flush credentials, local state, and managed-service files before atomic
  replacement to prevent empty or truncated files after a crash.
• Use the selected environment's SSH known_hosts file in maintenance tasks.
• Release completed runs from the eBPF bandwidth-counter map.
• Enforce SQLite foreign keys, briefly wait for locks, and write payment intent
  data atomically. Database upgrades report existing invalid rows.

Removed

• Remove unused verification scripts superseded by dbl, pkg/client, and
  verify_pcap.py.
• Drop big-endian eBPF artifacts and executor builds; supported Linux targets
  are little-endian.

Known limitations

• SCION traffic is not attributed to runs.
• The web dashboard is not fully compatible with authenticated sessions; use
  dbl or pkg/client for complete workflows.
• Packages are Linux amd64 only. Local state is package-version-specific, and
  interrupted runs are not recovered.