feat: publish Tend v0.2 preview source

Publish the reviewed allowlisted snapshot whose exact binary completed maintenance deployment, rollback, and reactivation exercises for Gamertan and Sandwich Hime.

Private-Source-Commit: 4d7094c8b7c61991bfb67b11fc1558724c874eb2

Private-Source-Tree: 54a2f74804f7acddf3755d7d4da5b97f5fc28381

AI-Assistance: OpenAI Codex assisted implementation, testing, security review, and release verification.
Signed-off-by: Cole Speelman <crspeelman@gmail.com>

internal/transport/receive.go

@@ -0,0 +1,48 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+
+package transport
+
+import (
+	"bufio"
+	"context"
+	"fmt"
+	"io"
+	"os"
+
+	"gamertan.com/tend/internal/deploy"
+	"gamertan.com/tend/internal/serverpolicy"
+)
+
+func Receive(ctx context.Context, input io.Reader, policy serverpolicy.Policy, manager deploy.Manager) (deploy.Report, error) {
+	if err := policy.CheckDirectories(); err != nil {
+		return deploy.Report{}, err
+	}
+	reader := bufio.NewReaderSize(input, maxHeaderBytes+4)
+	header, err := ReadHeader(reader)
+	if err != nil {
+		return deploy.Report{}, err
+	}
+	service, err := policy.CheckService(header.Service)
+	if err != nil {
+		return deploy.Report{}, err
+	}
+	if err = header.Validate(service.Policy.MaxArtifactBytes); err != nil {
+		return deploy.Report{}, err
+	}
+	file, err := os.CreateTemp(policy.IncomingRoot, ".tend-receive-"+header.Service+"-")
+	if err != nil {
+		return deploy.Report{}, err
+	}
+	path := file.Name()
+	defer os.Remove(path)
+	if err = file.Chmod(0o600); err == nil {
+		err = CopyArtifact(file, reader, header, service.Policy.MaxArtifactBytes)
+	}
+	if closeErr := file.Close(); err == nil {
+		err = closeErr
+	}
+	if err != nil {
+		return deploy.Report{}, fmt.Errorf("receive artifact: %w", err)
+	}
+	return manager.Deploy(ctx, service.Config, deploy.Request{Artifact: path, SHA256: header.SHA256, ApprovedSHA256: header.ApprovedSHA256, Activate: header.Activate})
+}