OwnTransit 0.1.8 — sustained tunnel fix (development preview)

Signed DEVELOPMENT PREVIEW, not a stable or production-qualified release.

Fixed: active SSH tunnels disconnecting within 30 seconds

The relay's pending-receiver timer could end a handler even after its connection
had become an active carrier. That closed the WebSocket underneath SSH. Version
0.1.8 makes expiry and promotion an atomic ownership decision.

Pending connections still expire. Active token/session limits, resource quotas,
endpoint authentication, authorization renewal and terminal alarms are unchanged.
This fixes availability without extending authorization.

Upgrade the relay only

curl -fsSL https://github.com/sentrybottale/OwnTransit/releases/download/v0.1.8/install-preview-linux.sh | sudo sh -s -- relay

Use the relay's existing public URL when prompted. Managed setup preserves keys
and routing, verifies the new relay, and rolls back if cutover fails. Keep an
independent access path during this restart.

Existing compatible clients and receivers need no update or new pairing codes.
The full macOS arm64, Linux amd64 and Linux arm64 capsules remain available and
retain the 0.1.7 terminal-input improvements.

Verification

A real-WebSocket regression fails on the old code and passes on the patch.
Additional tests cover pending expiry, claimed completion/shutdown, claim-expiry
races and preserved token/session bounds. Race/vet, security and publication
checks are required on the frozen source; signed capsules are verified separately.

The signed relay was exercised on an existing VPS with unchanged website
configuration and relay keys. Existing compatible Mac/Linux endpoints completed
a three-minute SSH session alongside a rate-limited SCP upload taking over two
minutes, followed by an integrity-checked download, with the previous access
service stopped. This is a bounded live check, not universal qualification.

No new wire profile, state migration or SSH change. No independent security
assessment or stable-release qualification is claimed. Initial bootstrap trusts
GitHub delivery, then verifies the pinned distribution key and signed archive.