Rivet 0.7.0

• Stage Racket's bundled foreign runtime libraries (libeay32.dll,
  ssleay32.dll, libgmp-10.dll) beside the Windows host executable.
  Embedded backends resolve these by bare DLL name through the FFI —
  OpenSSL for racket/openssl and the libcrypto factory (TLS and update/
  license verification), GMP for gmp-lib and math — and a package that
  only carried the Racket CS DLL died at startup or first crypto use with
  ffi-lib: could not load foreign library.
• Pin the MSI's Add/Remove Programs tile to the configured Windows icon
  (ARPPRODUCTICON); shortcuts and the executable already inherited it
  from the compiled resource.
• Adopt Keel as Rivet's transport-neutral schema contract. The new
  backend-schema->app-schema and current-backend-app-schema adapters project
  RPC, Event, State, Record, and Enum declarations into a validated,
  deterministic Keel app-schema while RVT1 framing and native renderers stay
  Rivet-owned. Align schema placement rules with Keel: Void is valid only as
  a direct RPC result, not inside parameters, containers, Records, Events, or
  States.
• Split the Linux system adapter into focused single-instance, notification,
  tray, autostart, secure-storage, and crash/shutdown implementation units,
  with one private XDG/D-Bus support core and no public API change.
• Make AppImage the signed Linux update payload when that format is enabled,
  emit its SHA-256 sidecar, and add install-kind-aware update selection so
  AppImage, portable, and package-manager installations cannot cross streams.
• Graduate the Linux package-manager lifecycle gates from a single install to
  two-version deb/rpm transactions: corrupt upgrades preserve the working
  install, normal upgrades replace both metadata and payload, Debian rejects
  implicit downgrade while Fedora verifies explicit local-RPM rollback and
  re-upgrade, and uninstall remains complete under native Wayland.
• Make embedded diagnostics opt-in across Racket, C++, and Swift. GUI hosts no
  longer write to standard error by default, preventing Windows applications
  from allocating a black console window on their first diagnostic; explicit
  structured-log and stderr sinks remain supported.
• Replace the accidental public backend registry structs and mutable State
  cell accessors with an opaque state? handle and a single immutable
  backend-schema reflection snapshot. Pre-1.0 tooling that used
  registered-* or *-info-* should read the corresponding schema entry;
  applications should use state-ref and state-set!.
• Add real Linux installer lifecycle gates: build x64 rpm/AppImage artifacts,
  install and launch the rpm on Fedora 44 under native Wayland, launch the
  AppImage outside the build tree on Ubuntu 24.04, uninstall the rpm, and
  retain package/compositor/application diagnostics as CI artifacts.
• Add first-party portable update installation for Windows, macOS, and Linux:
  verified ZIP/AppImage payloads are staged, platform-signature checked,
  atomically replaced, health-gated, durably committed, and recoverable after
  interruption. Native MSI/MSIX/DMG/PKG/deb/rpm artifacts remain explicitly
  owned by their system installer or package manager.
• Adopt a Wayland-first Linux display policy, document X11/XWayland as
  best-effort GTK compatibility, and launch the packaged GTK4 host through a
  headless native Wayland compositor in CI.