OnionGate v0.2.6-alpha.1

Warning

This build is not signed with an OS vendor certificate.
Verify it against SHA256SUMS and the build provenance
attestation before you run it.

• macOS: unsigned and un-notarized. Gatekeeper will refuse the
  first launch. See the install guide for the required steps.
• Windows: unsigned. SmartScreen will warn on first run.

Fixed

• Smart Connect no longer tries Snowflake or meek while the network lock is on.
  The lock drops all clearnet UDP, DNS included, so both transports stalled at
  10% and burned the 75-second timeout. Smart Connect now skips them and says
  why. With Smart Connect off, starting or applying a Snowflake or meek config
  under the lock is refused up front instead of timing out.
• Linux egress leak monitor now sees live sockets (ss -tuapnH) and parses the
  Netid column, so established clearnet connections are no longer invisible.
• Tor expert-bundle download falls back to archive.torproject.org when
  dist.torproject.org 404s on an older pin, so clean CI/local builds work.
• Headless start no longer exits 1 when there is no D-Bus session for GNOME
  proxy writes; Tor-up is enough when the proxy backend is unsupported.
• A failed start releases the transition network lock unless a kill switch /
  fail-closed NIC lock is armed, so host DNS/UDP are not left blocked.
• Corrupt settings.json fails closed instead of silently loading weak defaults.
• Reopen-bundle path policy uses POSIX string rules on every OS so Windows CI
  no longer rejects valid ledger paths.

Changed

• Docs and GitHub release notes mark plain v0.2.0…v0.2.4 as superseded:
  install only the current *-alpha* build. Older releases stay published as
  prereleases (not Latest) so checksums and assets remain reachable.