feat: publish Tend v0.2 Preview 2 source

Export the reviewed allowlisted snapshot from private source commit 8aab3db43f35e6a49aa497f45d73701b13fc9f32 and tree 992132ea4703437dc13ffdbb04a077816c02caf9. This includes routed singleton continuity, deployment evidence, strict schema-2 configuration, restricted transport, and the independently compilable public-tree guard.

AI-Assisted: OpenAI Codex
Signed-off-by: Cole Speelman <crspeelman@gmail.com>

docs/SCHEMA_V2_MIGRATION.md

@@ -14,12 +14,19 @@ been exercised.
 5. Set every service's `deployment.lock_file` to
    `/run/lock/tend-deploy.lock`.
 6. Add one or more query-free HTTPS `deployment.public_smoke` checks.
-7. Update installed systemd units to read the same environment file as the
+7. Add a per-service `deployment.event_log` below its release root and a
+   bounded `deployment.activation_window_seconds` value. Keep the log
+   root-owned and grant collectors read access explicitly.
+8. For singleton services, add the full Caddy configuration, imported handler,
+   and one-upstream handler-template paths. The template must be reviewed and
+   contain exactly one `{{UPSTREAM}}` marker so Tend can keep traffic on the
+   candidate while the fixed-address unit restarts.
+9. Update installed systemd units to read the same environment file as the
    transient candidate.
-8. Install a root-owned `0600` receive policy mapping each service name to its
+10. Install a root-owned `0600` receive policy mapping each service name to its
    exact configuration and artifact-size ceiling.
-9. Run `tend check-server` as root before accepting a transfer.
-10. Validate, activate, rollback, and reactivate one service at a time. Confirm
+11. Run `tend check-server` as root before accepting a transfer.
+12. Validate, activate, rollback, and reactivate one service at a time. Confirm
     unrelated services never restart.
 
 Tend does not discover `.env`, infer old values, rewrite a production file, or