feat: publish Tend v0.2 Preview 2 source

Export the reviewed allowlisted snapshot from private source commit 8aab3db43f35e6a49aa497f45d73701b13fc9f32 and tree 992132ea4703437dc13ffdbb04a077816c02caf9. This includes routed singleton continuity, deployment evidence, strict schema-2 configuration, restricted transport, and the independently compilable public-tree guard.

AI-Assisted: OpenAI Codex
Signed-off-by: Cole Speelman <crspeelman@gmail.com>

docs/THREAT_MODEL.md

@@ -7,11 +7,17 @@
 - Release roots, state, pointers, and Caddy files reject symlink substitution
   at their checked boundaries.
 - Configuration is strict JSON and is never interpolated into a shell command.
-- Candidate health is established before traffic or the singleton current
+- Candidate health is established before traffic or any current release
   pointer changes. New deployments also satisfy configured content smoke
   checks; rollback uses health and readiness because future-release content
   markers are not valid requirements for an older retained release.
 - Caddy configuration validates before reload.
+- Canonical routed origins and the previous blue/green slot or singleton
+  handoff candidate remain under probe for the configured activation window; a
+  failure restores the old handler and release pointer.
+- Desired, candidate, active, previous, and failed-attempt identities remain
+  distinct in state. Bounded deployment events contain no arbitrary command
+  output or environment values and cannot block deployment.
 - An activation failure restores the previously observed state.
 - Active and previous releases survive pruning.
 - The restricted receiver accepts one versioned bounded stream, one allowlisted