v0.15.0

Added

• deployment.ActivateInstalled activates only a caller-packaged app at one
  canonical full path. Its schema-v1 receipt seals daemonkit's fresh 64-hex
  operation ID, exact build and policy, bundle and entitlement digests, Team
  ID, signing identifier, designated requirement, CDHash, inode, service plan,
  and operation-bound readiness proof before reporting active.
• StatusInstalled distinguishes an exactly verified but unactivated app from
  prepared and active receipts. AttestInstalled returns the read-only signed
  bundle, entitlement, tree, and file-identity facts consumed by activation.
  DeactivateInstalled requires exact receipt
  ownership, quiesces through a request-scoped runtime stopper, removes only
  receipt and service state, and leaves the packaged app untouched.
• Swift StaticSessionServiceRuntime<Request, Response> owns one typed,
  same-EUID service generation from listener acquisition through Ready,
  draining, request settlement, unlink, and retained terminal result.
• SessionServiceHandler, SessionServiceCodec, and
  SessionServiceConfiguration make the product route and every transport
  bound explicit while keeping raw socket requests and responses internal.
• The Swift service runtime owns receipt and readiness control operations;
  ServiceSocketClient follows an authenticated successor without product
  code implementing lifecycle framing or retry policy.

Changed

• Protected runtime controls are exact unary calls with an empty tenant and
  are rejected before product dispatch when their framing is incomplete.
• A session owns at most one readiness subscription. Duplicate registration is
  rejected with SocketResponseCode.readinessSubscriptionExists; the service
  client retires that session and reconnects instead of replacing an active or
  terminal-settlement owner.
• Trust is evaluated against the peer's effective UID before a session can
  reserve capacity or send application bytes.
• Shutdown has one deadline-independent settlement task. A caller deadline can
  expire, but a later shutdown joins the same drain and reaping work.

Removed

• Deploy, Recover, staged replacement, artifact-driven signed-app
  publication, and WithSignedAppDeploy are removed. Packaging owns app bytes;
  daemonkit owns activation only, with no compatibility or adoption path.
• Swift consumers no longer construct public raw SocketServer,
  SocketRequest, or SocketResponse service loops. There is no compatibility
  wrapper for the deleted public server surface.