v0.21.2

Added

• feat(apptainer): spec.apptainer.tmpfs_size (default 2G) — relocate
  the container /tmp + /var/tmp onto the host filesystem via --workdir,
  so a --containall agent isn't capped at the 64 MB session tmpfs mid-run.
  Fails loud (TmpfsSpaceError) below the requested size; no-op when ""
  or when the operator already passes --workdir. (#187)
• feat(fleet): sac fleet sync — cross-host spec.yaml + to_home/**
  audit across every peer in config.yaml, fail-loud on any divergence
  (no auto-merge). Worker --collect, --peer, --only,
  --allow-unresolvable, JSON output. (#207)
• feat(acl): Phase-3 server-managed ACL enforcement (ADR-0010) —
  per-spec spec.comms (outbound/inbound siblings/parent allow|deny,
  a2a.listen) and spec.lineage (group, may_spawn), persisted to
  state.db and enforced at the listen send path and the spawn gate. (#206)
• docs(readme): Models section + spec-reference "Available models"
  (opus/sonnet/haiku aliases → current 4.x families, [1m] context, full
  versioned IDs, provider override); skills spec.claude field table
  (account + provider); ADR-0012; refreshed CLI surface (fleet/host/accounts).
• feat(base-image): apt-based fd/rg/bat/eza with Debian symlinks. (#205)

Fixed

• fix(mcp): account tools call renamed accounts subcommands — the MCP
  account_show / quota_watch tools invoked the removed account /
  quota watch CLI verbs; repointed at accounts status /
  accounts watch-quota. (#231)
• docs(skills): purge v2-era field references from _skills/scitex-agent-container/ —
  brought seven skills in lockstep with the v3 validator (config/_validation.py),
  which strictly rejects spec.remote, metadata.name, top-level
  spec.model, spec.skills, and dot_claude. Highlights: full rewrite
  of 11_remote-deploy.md to spec.host / spec.hosts + sac --on <peer>
  dispatch; YAML example in 01_config-v3.md no longer ships
  spec.skills / top-level spec.model / multiplexer-alive; A2A
  AgentCard mapping in 07_a2a-protocol-extension-fields.md points at
  the dir-as-SSoT name source and the file-based skill layout;
  19_full-agent-troubleshooting.md replaces the spec.skills.required /
  spec.skills.available table with the to_home/.claude/skills/<id>/
  delivery mechanism. Added validator tests covering the unknown-spec-field
  catch-all and the metadata.name / dot_claude / spec.skills
  rejection messages; relocation-vs-unknown messages stay distinct.