Harden runtime security, portability, and release retries

[Llewellynvdm]

Summary

This PR implements the functional-test remediation against master commit 2d6b53a, with the related security and portability corrections required for a durable fix.

• installs the TTL reaper as a root-owned runtime under /usr/local/libexec and hardens its systemd sandbox, instead of executing root code from a user-writable checkout;
• makes VM launch metadata atomic, supports environments without USER, and removes an incomplete VM when startup fails;
• replaces implicit sudo incus fallback with explicit privilege selection and bootstrap-managed incus-admin onboarding;
• fixes guest runtime cleanup and keeps VM listing usable when the optional column formatter is absent;
• makes Gitea release publication semantically idempotent, including signed-marker retries, strict marker-member validation, and deterministic timestamps from manifest.json;
• carries AGENT_USER and AGENT_HOME consistently through provisioning, verification, MCP toggling, model configuration, and session execution;
• consolidates the previously uncalled guest checks into verify-image.sh and adds browser/non-browser Playwright invariants;
• validates the provider, MCP, and session-policy authorities, adds executable regression suites, and introduces make ci;
• runs repository validation on both Ubuntu 24.04 and Ubuntu 26.04 GitHub-hosted runners;
• updates operator, security, release, compatibility, and limitation documentation.

Root causes

The existing suite read most deployment scripts without executing their runtime paths. That allowed shell-environment assumptions, host/guest glob confusion, optional-tool coupling, and retry-state drift to remain invisible. The reaper installer also crossed a trust boundary by pointing a root system service at the mutable checkout.

Security impact

The service keeps ProtectHome=true, executes only root-owned installed files, uses an explicit Incus Unix-socket boundary, and drops Linux capabilities. Normal commands no longer elevate automatically after an arbitrary daemon or permission failure. Completion markers are treated as untrusted archives and read without filesystem extraction.

Validation

• make ci
  • repository syntax and generated-state validation;
  • Python manifest, authority, and security tests;
  • executed launch rollback, cleanup, listing fallback, Incus-access, session, and reaper regressions;
  • signed Gitea publication retry/idempotency test;
  • systemd unit verification;
  • image package export/import/tamper round trip.
• git diff --check
• workflow YAML parse validation
• GitHub Actions run 39: Ubuntu 24.04 and Ubuntu 26.04 validation and package round-trip jobs passed
• remote comparison confirms this branch is two commits ahead of master and contains the intended 47-file diff.

Remaining hardware gate

This environment has no KVM or live Incus daemon. Real image builds, live bridge/ACL enforcement, and the installed timer must still pass the documented Ubuntu 24.04 and 26.04 hardware acceptance matrix before release promotion. The PR keeps that limitation explicit rather than claiming container-only tests prove it.