0.9.0 — Replace bundled Caddy with native HTTPS

Both deployment entrypoints now use kernel HTTPS. The migration imports supported certificates, ACME accounts, local CA material, admission history and settings without replacing existing keys.

The attached amd64/arm64 migration bundles are pinned by the kernel 0.9.1 updater. Existing bundled-Caddy installations on kernel 0.7.4 or newer must finish the update, then restart the container once. Update both roots of a dev/prod pair before restarting. The old proxy remains until this restart; native listeners then take its ports.

Upgrade instructions.

Validation: real native installs and released 0.7.4/0.8.7 upgrade paths using the actual legacy Caddy supervisor; certificate, key, limits and port preservation; focused reader, entrypoint, pair and interrupted-update checks. Docker image build/run tests were explicitly excluded.