v0.3.19

[0.3.19] - 2026-08-06

Added

• Cutover Passport — guestkit passport emit|verify: versioned CI-gateable
  assurance artifact (evidence digest, boot/migration scores, FixPlan digest,
  Windows BitLocker hard-block + windows_offline_ready, optional live
  attestation via agent-proxy, optional Ed25519 sign). Suite handoff points to
  HyperSDK (export) + hyper2kvm (convert/deploy). Web: POST /vms/:id/passport
  • dock download. Worker op guestkit.passport.
• plan generate -p windows-domain-leave — offline domain→workgroup
  markers (--workgroup, default WORKGROUP).
• plan generate -p windows-timezone — offline TimeZoneKeyName
  (--timezone).
• plan generate -p windows-static-ip — offline static IPv4 on a known
  interface GUID (--interface-guid --ip --mask [--gateway] [--dns]).