chore(release): staged fleet rollout of the epic #98 release without disruption #115

Context

Epic #98 changes many command and module paths. The owner requires that updating the managed fleet from v0.18.1 to the next release causes no disruption. This issue is the release and rollout procedure. The release itself and every fleet mutation still need the owner's explicit go-ahead (release guard in AGENTS.md).

Facts from the 2026-11-10 review (verified against main 79f1dc5 and the open PRs #101, #105, #114):

• verified: no config struct, fingerprint, loader-default or minimal/base/rocky profile change since v0.18.1 (only fix(profiles)!: keep site-specific and no-op values out of the embedded profiles #101 adds --vlan-address handling in the loader). Applied-config fingerprints stay stable, so the v0.18.0 "fingerprint is missing" failure (fix(config): keep config fingerprints stable when exporter_firewall is unset #85) cannot recur.
• verified: the remote command lines the controller sends (apply --yes [--dry-run] --config, update --version, schedule enable|disable, status|check|doctor -o json) and the schedule unit commands (check -o json|prometheus, doctor -o json|prometheus) use only flags the new CLI still accepts on those commands (fix(cli): reject ignored root flags and validate capabilities on every mutating command #91 reader declarations).
• verified: release binaries are CGO_ENABLED=0, so the Go 1.26.10 toolchain (ci: improvement plan from the 2026-11-07 CI survey (toolchain pinning and required checks) #87) adds no glibc requirement for Ubuntu 20.04 or Rocky 8 hosts.
• verified: managed sshd drop-ins already carry Port <n> when ssh.port is set, so the fix(firewall): block SSH and UFW changes when firewall state is unknown #89/fix(ssh): run the Rocky SSH firewall check only when the port changes #104 firewall verification runs only on a real port change; an unchanged port stays untouched.
• verified 2026-11-10: rootfiles fleet check --all on the managed fleet (v0.18.1) is clean on every host, so any drift reported after the update comes from the new release.
• inferred, to prove on the canary: fix(module): route writes through Runner, align Check with Apply, keep tests off the host #93 changes some Check output (time-sync service, Docker service and compose link, locale tools). On hosts already converged these should not report drift.
• chore: remove dead code and update outdated defaults #95 was amended on 2026-11-10 so the header rename and compose link removal cannot rewrite files or restart services on existing hosts.

Decisions

• Merge all epic PRs first and cut one release. No partial fleet rollout of an intermediate version.
• Canary first, then one host at a time. Rocky hosts and the tenant host get their own steps.
• Stop condition: any host where fleet check after fleet update is not clean, or where doctor gets worse than before. Investigate before continuing; never fleet apply to make an unexpected drift go away.
• The operator Mac's controller binary is updated to the same release before the fleet steps.

Design

1. Release candidate: all epic PRs merged, CI green, release notes compiled from the PR bodies (### Action needed must be empty for fleet hosts, or each item must be handled below).
2. Pre-flight (read-only): fleet status --all, fleet check --all, fleet doctor --all on the current release; save the JSON as the baseline.
3. Controller: update the Mac binary; re-run fleet status --all to confirm the new controller reads the old hosts.
4. Canary (one GPU host with monitoring and no tenants): fleet update --host <canary> --version vX --timeout 25m, then fleet check and fleet doctor on it. Expected: clean, no apply-pending. Only if a planned change shows, review it, then fleet apply --host <canary> --dry-run before a real apply.
5. Remaining Ubuntu GPU and studio hosts, one at a time with the same check.
6. Rocky hosts, one at a time (different package, SSH Include and SELinux paths).
7. Tenant host last: also confirm running GPU containers still see their GPUs (nvidia-smi -L inside each) after the update.
8. Post: fleet check --all and fleet doctor --all clean; record versions and backup IDs in the private fleet record.

Changes

• No code. Release notes docs/releases/vX.Y.Z.md in the release PR.

Acceptance criteria

• AC1: every epic chore: 2026-11-09 audit plan (commands, modules, docs, specs) #98 PR is merged and CI is green on the release commit.
• AC2: canary shows clean check and unchanged-or-better doctor after fleet update, with no fleet apply needed.
• AC3: all hosts updated; fleet check --all and fleet doctor --all clean afterwards.
• AC4: no service restart caused by the update other than those listed in the release notes (sshd, fail2ban, journald, cloudflared, docker untouched on converged hosts).

Tasks

• T1: release PR with notes (owner authorizes the tag)
• T2: baseline JSON (read-only)
• T3: controller update
• T4: canary update and verification
• T5: serial rollout (Ubuntu, then Rocky, then tenant host)
• T6: final verification and record

Out of scope

• Changing host site configs. Hosts keep their current configs.