v2026.4.13 — Tenancy + Hardening Day

Major release covering 7 backlog items shipped today:

S1 — Generic credential sanitizer
S3 — Security-critical audit log
S5 — Hybrid self-service cert rotation
U1 — Tighter zombie-peer lifecycle (10s heartbeat / 25s stale)
U2 — bun cli.ts init <URL> one-command device setup
U3 — bun cli.ts doctor (11 health checks)
S2 — Hard multi-tenancy via UUID namespaces and cert bindings,
     plus cert revocation, receiver-scoped message ack, and a
     poll fallback for non-channel-mode operation

Plus: README rewrite, automated CHANGELOG via git-cliff, CalVer
image tags, auto-update on MCP startup.

73 tests across 7 files. Migration is irreversible: drops legacy
namespace string columns after backfill into UUID-based namespace_id.