Repository navigation
Both deployment entrypoints now use kernel HTTPS. The migration imports supported certificates, ACME accounts, local CA material, admission history and settings without replacing existing keys.
The attached amd64/arm64 migration bundles are pinned by the kernel 0.9.1 updater. Existing bundled-Caddy installations on kernel 0.7.4 or newer must finish the update, then restart the container once. Update both roots of a dev/prod pair before restarting. The old proxy remains until this restart; native listeners then take its ports.
Validation: real native installs and released 0.7.4/0.8.7 upgrade paths using the actual legacy Caddy supervisor; certificate, key, limits and port preservation; focused reader, entrypoint, pair and interrupted-update checks. Docker image build/run tests were explicitly excluded.