v0.0.77

Ordinary managed ensure now prepares TLS certificate coverage for resolved proxy hostnames before provider startup and repository hooks. Existing certificate names, shared locking, admission refusals, and retained-runtime repair behavior are preserved.

Source fix: #97. Release artifacts: #98.

Validation: 2,260 source tests passed, including managed ensure regressions and additive TLS coverage tests. Local release documentation, build, and isolated package checks passed. Live trusted TLS verification passed for six consumer hostnames; the consumer subsequently stopped successfully. Application readiness remains unproven because its authenticated fixture startup failed.

Agent adaptation: upgrade prompt.