Prepare beta100 exact recovery and truthful health

[callumalpass]

Summary

Prepare beta100 with the bounded exact-recovery/truthful-health series and its review corrections:

• Retain unresolved updater transactions; serialize recovery, daemon startup, IPC and installation through the boot gate. Canonical readiness is not PID/socket reachability.
• Continue editor mutations through their original SDK handles. Settle definitive failures using SDK-owned pending state, preserve drafts, and retain genuinely unknown work.
• Distinguish immediate credential revocation from confirmed local enforcement, using the immutable policy barrier and exact current-generation ACK.
• Keep desktop resource errors and last-known inventories scoped and truthful.
• Bound relay retries within the existing owner; rearm transient mirror credential failures without adding credential or process supervisors.
• Admit the exact verified rollback runtime and preserve its app-bound selection across restarts and subsequent update attempts.

Integration with current main

Merged current main without dropping authority-import recovery or the independent Editor inventory fix. Keep local control protocol v5. Main already owns 0031_authority_import_abort_receipts.sql, so the new additive revocation migration is 0032_local_revocation_confirmation.sql. Both migration histories are tested. Move ordinary CLI launch into its existing lifecycle module rather than relaxing the desktop composition-root line limit.

All workspace versions and both Rust locks are aligned to 0.1.0-beta.100; beta99 remains the published predecessor. No release tag has been created.

Validation

• Integrated and versioned source: pnpm test:fast — 2,111 JS passed; 644 Rust passed (optional server tests and documented Rust ignores remain explicit).
• All workspace typechecks; real isolated local daemon/control/browser/grant E2E.
• Nine real PostgreSQL tests covering both local revocation and authority-import abort receipt behavior.
• Version/readiness/component checks, architecture checks, formatting, and Git whitespace checks.
• Permanent regression coverage for immediate/deferred editor rejection, unresolved probe errors, rollback admission, cold restart, wrong version/protocol/schema, missing/invalid fallback paths, subsequent update failures and failed durable writes.

Release boundary

This PR is product integration, not deployment approval. Current private release inspection supports control-plane endpoints only through 31. Production remains beta99; schema32 requires separately reviewed operational inspection/catalog support, exact signed candidate registration and qualification before staging/promotion. No guard waiver, migration reset or image-only rollback is proposed here.

Native keyring/service-manager behavior, signed interrupted-updater/first-adoption rollback and broader LAB fault cuts must not be inferred from local fixtures. A preserved daemon lacking canonical readiness remains fail-closed, rather than being declared healthy from liveness. Public npm/desktop/Editor publication stays after verified backend production promotion.

[callumalpass]

Release coordination: #431 pins merged mdbase-rs fc1dc077 for optional selected-write membership. Spec mdbase-dev/mdbase-spec#52, Rust callumalpass/mdbase-rs#78, TypeScript callumalpass/mdbase#14 and App callumalpass/tasknotes-app#161 are merged; the App fix is web-deployed and uploaded as iOS1.0.3 build15 to TestFlight. Please retain the engine pin when updating this beta100 candidate from main. I am not creating a competing beta100 version/tag or bypassing this candidate’s schema32 operational gate. #431 remains product integration, not evidence of backend deployment.