v0.6.8

Federation gateway-tag fix

A focused follow-up to v0.6.7's gateway-outage work, closing the last federation edge case found during production gateway testing.

Bug fix

• Federated imports kept gateways un-reapable (#224). When one region imported another region's nodes into the shared layout, it tagged them with only the remote cluster name — dropping tier:gateway. If such an imported gateway role later orphaned (e.g. a gateway lost its identity), the tombstone reaper — which finds gateway roles by their tier:gateway tag — couldn't see it, so the dead role stuck in the layout. Imported nodes now carry the proper tier:gateway/tier:storage tags (the remote-name tag is retained for stale-node cleanup).

Hardening

• Skip importing a down remote node, so a just-orphaned role isn't re-imported before its removal propagates across the federation.
• Reaper backstop for tag-stripped orphans: in a unified Auto cluster, a local-zone capacity:null role with no live or operator-claimed owner is reaped even if a re-import stripped its tier tag — but only after it has been continuously down past the same dwell PeerUnreachable uses, so a transient blip or briefly-down federated peer is never reaped on a single snapshot.
• Self-connection guard now compares the effective local zone (applying the empty→"default" fallback), so a cluster with an unset spec.zone correctly recognizes a remote configured zone: "default" as itself and never pulls its roles into the local zone.

Notes

• No API/CRD changes. Operator-only upgrade — Garage pods and node identities are unaffected.
• In a federated deployment, layoutManagement.autoApply: true is safe on v0.6.7+ (zone-scoped reaper) and this release further hardens the reaper against over-reaping imported roles.