v0.30.1

Changed

• A supersede verifies the prior and candidate generations with codesign around
  the swap again and retires the prior tree inside land, restoring the 0.29.0
  sequence. The 0.30.0 attest-once swap could wedge Activate after a crash,
  land a candidate mutated after its identity check, delete a prior tree a
  helper was still running from, and accept bytes whose extended attributes
  codesign rejects. The --compile-bytecode install stays.