v0.18.0

Added

• trust.VerifierWorkerBudgets fixes the verifier worker lane's time and byte
  bounds as daemonkit-owned constants, so the verifier lane no longer inherits
  the product pool's budgets and a product configuration can never truncate a
  verifier verdict. Caller deadlines beyond the lane's time budget clamp to it.
• trust.ProcessVerifier.Probe runs one complete verifier child exchange and
  reports transport health only; any well-formed verdict passes.

Changed

• Breaking: worker.Pool.ClaimRuntime now takes worker.VerifierBudgets
  (pass trust.VerifierWorkerBudgets()); direct callers must update. Products
  that only construct pools are unaffected.
• daemon.Runtime.Begin self-probes the trust verifier after worker activation
  and before serving. A daemon whose executable does not dispatch
  trust.RunVerifierChild, or whose verifier lane cannot complete an exchange,
  now refuses to start with daemon.ErrTrustVerifierProbe instead of silently
  rejecting every peer as untrusted.
• The wire server logs peer-verification infrastructure failures — worker
  kills, decode failures, child exec errors, and fail-closed verifier absence
  (trust.ErrNoVerifier) — at Error level; policy denial verdicts keep their
  Debug logging. The peer-facing response stays PeerUntrusted in both cases.