real-image Stage 1 smoke with a local fake subscription and the pinned Mihomo binary
This PR implements Stage 1 only; scheduling, process startup/reload, Compose secrets, and ExternalUI lifecycle remain for Stage 2.
## Summary
- add a one-shot Stage 1 command that reads the subscription URL from a runtime secret
- normalize confirmed Clash/Mihomo YAML into the fixed local ACL4SSR template
- validate with pinned Mihomo before atomically switching the `/data/last-good` generation
- keep the previous valid generation on download, YAML, validation, or publication failure
- pin the YAML dependency and assert Mihomo, ACL4SSR, and template asset versions
## Verification
- `./scripts/test.sh` (race tests, 76.0% bootstrap coverage)
- `go vet ./...`
- `./tests/container-smoke.sh`
- real-image Stage 1 smoke with a local fake subscription and the pinned Mihomo binary
This PR implements Stage 1 only; scheduling, process startup/reload, Compose secrets, and ExternalUI lifecycle remain for Stage 2.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
/data/last-goodgenerationVerification
./scripts/test.sh(race tests, 76.0% bootstrap coverage)go vet ./..../tests/container-smoke.shThis PR implements Stage 1 only; scheduling, process startup/reload, Compose secrets, and ExternalUI lifecycle remain for Stage 2.