feat: publish Gamertan Tend preview source

Sanitized root snapshot from private source commit a72903c63e1753f9e6ffbf40453c0830bdfc05c5 and tree 295641e67eef5979da76746d8ae271249568263e. Private development history and workflows are excluded by the exact allowlist.

AI-assisted: OpenAI Codex helped implement, test, and audit this preview.
Signed-off-by: Cole Speelman <crspeelman@gmail.com>

docs/THREAT_MODEL.md

@@ -0,0 +1,39 @@
+# Threat model
+
+## Protected properties
+
+- A release is identified by an operator-approved SHA-256 digest.
+- Only regular, bounded, allowlisted archive entries are extracted.
+- Release roots, state, pointers, and Caddy files reject symlink substitution
+  at their checked boundaries.
+- Configuration is strict JSON and is never interpolated into a shell command.
+- Candidate health is established before traffic or the singleton current
+  pointer changes. New deployments also satisfy configured content smoke
+  checks; rollback uses health and readiness because future-release content
+  markers are not valid requirements for an older retained release.
+- Caddy configuration validates before reload.
+- An activation failure restores the previously observed state.
+- Active and previous releases survive pruning.
+
+## Trusted inputs
+
+Reviewed source, the Go toolchain, root-owned `tend.json`, systemd unit files,
+the Caddy handler template, the operator, and the target host's root account are
+trusted. Packaging a hostile repository can execute hostile Go compiler hooks
+or consume resources; Tend is not a source-code sandbox.
+
+## Adversarial inputs
+
+Artifact paths and bytes, archive metadata, stale or malformed state, HTTP
+responses, subprocess failures, and filesystem objects at managed paths are
+validated and fail closed. Process output is bounded.
+
+## Non-goals and preview limits
+
+Tend does not defend against a concurrently malicious root user, a compromised
+kernel/toolchain/systemd/Caddy installation, denial of service by the trusted
+application, or secrets already exposed through service configuration. v0.1
+does not manage data migrations, databases, containers, Kubernetes, or
+application-specific activation. Transfer remains an application-local,
+reviewed step until a transport can be added without weakening host-key and
+credential boundaries.