Introduces fail-closed SSH bootstrap support for remote Linux hosts with fixed command execution, wheel hash verification, privileged and user-mode install paths, plus new controller/API/CLI endpoints for bootstrap planning and execution. It also hardens host lifecycle behavior with identity-mismatch handling, machine-readable SSH disconnect errors, cached hello identity, storage candidate discovery, and enforcement updates for delegated cgroups and directory-reservation storage quotas, with docs and tests expanded accordingly.