v0.4.0

Trust and polish for the install path (INSTALL_UPGRADE_PLAN.md phase 4), and the first release signed with a key installers can verify against.

Added

• DNS is checked before the stack starts. install.sh resolves the dashboard hostname and a random label under the wildcard domain, compares them against this host's addresses, and says so before Let's Encrypt burns a failed challenge against a name that does not reach you. It asks rather than refusing — split-horizon DNS and a pre-cutover install are legitimate — and --skip-dns-check turns it off.
• --dry-run reports what an upgrade would change: release, image and asset versions, download size against free disk in both filesystems, which settings would change, and whether a snapshot would be taken. It writes nothing.
• --yes for unattended runs: never prompts, takes the prior value for every question. It deliberately does not answer the post-failure rollback question — that is what --auto-rollback is for.
• A concurrency lock. Two installers at once raced on .env, versions.env, config.yaml and docker compose up; the second now waits and then refuses.
• Release signing. make publish can sign a release with a key that is not on the web host (scripts/release-key.sh generates one), and install.sh verifies it against a key embedded in the script, then refuses any artifact whose digest is not in the signed payload. Until now the only integrity check was a digest served by the same origin as the bytes, which catches corruption but not a compromised registry. Unverifiable releases warn and install; DEVGRAIL_REQUIRE_SIGNATURE=1 makes them a refusal. The trust model, the signed payload format, and the key rotation procedure are documented in docs/SECURITY.md.
• docker-compose.override.yml is supported. The compose file and Traefik config are product-owned and rewritten on every run; local changes belong in the override, which the installer never touches and now passes to every compose invocation. Documented in docs/RUNBOOK.md.
• README.md with an OS/arch support matrix and minimum RAM/disk, and a LICENSE.
• A test asserting migration numbers stay unique, so the collision that exists today (005_api_keys / 005_projects) cannot be joined by another.

Changed

• The registry's "current release" no longer depends on scan order when two releases are published in the same millisecond.
• The admin dashboard marks each release as signed or unsigned.
• install.sh installs openssl alongside jq when it is missing.
• The VPS marketplace / cloud-init packaging described in the spec is now marked explicitly as not built.
• Publishing a release is one command: scripts/publish.sh takes the version from this file, finds the registry URL, tokens and signing key on its own, and runs on Windows as well as Linux. make publish is unchanged.

Fixed

• arm64 workspaces get a terminal that runs. The workspace image fetched the x86_64 ttyd binary whatever it was being built for. The pinned digest matched (it is the same file), so the build passed and the breakage only appeared on a customer's arm64 host, where the terminal could not start. The binary is now chosen by TARGETARCH, with a pinned digest per architecture, and an unrecognised architecture fails the build instead of shipping.