Z-Manager CLI 2.2.0 አውርድ

# ZManager CLI 2.2.0 Release Notes

ZManager CLI 2.2.0 adds restart-safe hosted TZAP authentication and certificate recovery, strengthens archive extraction limits, and expands cross-platform release validation.

## Highlights

### Hosted TZAP identity lifecycle
• Added browser-based hosted login with PKCE, loopback callbacks, and durable handoff recovery.
• Bound sessions and hosted device identities to their authenticated user, environment, and service origins.
• Added restart-safe certificate enrollment and renewal reconciliation, plus journaled recovery for local identity catalog writes.
• Kept signing keys in native secret stores while exposing local certificate and contact workflows through the CLI.

### Archive safety and recovery
• Reject extraction paths that would traverse selected or existing symbolic-link ancestors.
• Bound decoded archive intermediates before trusting metadata, with cancellation support.
• Improved nested Debian package payload handling and added coverage for hostile archive and filesystem edge cases.
• Preserve existing outputs and identity catalogs after disk-full or interrupted writes; retry safely after recovery.

### Cross-platform builds and supply-chain checks
• Pin and validate the forensic reader forks used by builds instead of updating unrelated sibling checkouts.
• Add scheduled RustSec and offline identity/package audit workflows.
• Validate macOS archive behavior against native Apple tools and build/test Windows ARM64 with the same Rust toolchain as macOS.
• Keep offline and hosted CLI profiles available as separate release packages.

## Upgrading

This release adds hosted identity and recovery flows without changing the existing archive command interface. Existing offline workflows remain available in the offline package.