[CMGS]

Fixes and speedups from a whole-repo read of silkd, the Python SDK, CI, packaging and docs. Stacked on #420.

Fixes

• silkd fs_find hung forever on a zero-length file that never yields data (/proc/kmsg) or a FIFO, and fs_replace on a writerless FIFO did the same; the blocking thread leaked per retry. The file is opened with O_NONBLOCK, as fs_read already does: find skips it, replace answers an error frame.
• silkd glibc headroom. The glibc build ran on trixie (glibc 2.41) and already needed GLIBC_2.39, Ubuntu 24.04's own version. It builds on bookworm now: highest needed symbol GLIBC_2.34 (checked on a local linux/arm64 build before and after).
• Python relay had no TCP keepalive, so a partitioned node blocked a call without a timeout forever. The socket sets SO_KEEPALIVE and Go's default timings where the platform has them.
• systemd unit gave up after a short PG outage at boot: sandboxd exits fast when the meta store refuses, and the default restart limit trips in about 2 s. RestartSec=5s in the unit and the docs copy.
• images workflow could go green without building a change: a cancelled pending run's change was never diffed again (happened twice), and a force push diffed against a missing object and built nothing. The base is now the last successful run's commit; no base or a missing object builds everything.
• release workflow refuses a tag that does not match silkd/Cargo.toml, as the PyPI workflow already does.
• egress-e2e prints the missing-bridge message instead of exiting silently.
• Docs corrected where they promised more than the code does: pipelining behind a read on a sleeping relay, request frames during fs_write/fs_push, the dirty marker and other mount namespaces, e2e scripts removing every sbx-* VM on the root, layer reproducibility with unpinned packages, goldens after a cocoon or Cloud Hypervisor upgrade.

Performance (A/B in one process, arms alternated, order swapped; silkd in a linux/arm64 container)

• fs_find skips a file whose whole body has no match before the per-line scan (not for anchored patterns): 5 MB / 592 files, sparse pattern 4.55 -> 1.89 ms, dense err 25.6 -> 25.0 ms.
• stdin frames use the hand-written decode path data frames use: 128 MiB of stdin 69.4 -> 47.5 ms.
• fs_read reads the first chunk in the open hop: 4 KiB file 53.8 -> 23.8 us p50, 64 KiB 84.1 -> 43.6 us.
• Python reads relay frames through a 64 KiB buffer instead of 8 KiB: 512 MB of 256 KiB frames 1351 -> 1251 ms (Linux).

Not changed

• attach noticing a client hang-up: the protocol keeps streaming after a client half-close, which a hang-up cannot be told apart from. The residue is one guest task until the process writes or exits.

Tests

Each fix and speedup has a test that fails against the old code or a mutant. cargo fmt/clippy/test on macOS and in a linux/arm64 container; ruff, mypy, pytest; shellcheck.

Update

• Python keepalive also sets the idle time on macOS, where the option is TCP_KEEPALIVE.
• fs_read sizes its first chunk by the file's length: musl 100 B 21.1 -> 15.0 us, glibc unchanged.
• The golden paragraph in docs/deploy.md describes pool, store: dead warm VMs, shared staging, cache reclaim, volume unmount budget #427, so merge that first.