Phase 14 worker identity hardening

.dockerignore

@@ -0,0 +1,22 @@
+.git
+.github
+.codex
+dist
+bin
+stacyvm
+stacyvm-agent
+checksums.txt
+
+web/node_modules
+web/dist
+sdk/js/node_modules
+
+images/evm/contracts/lib
+images/evm/frontend/node_modules
+images/evm/frontend/.next
+
+*.log
+*.db
+*.db-shm
+*.db-wal
+.env

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,71 @@
+name: Bug report
+description: Report a reproducible StacyVM bug with the evidence needed for maintainers to triage it.
+title: "[Bug]: "
+labels: ["bug", "needs-triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to report this. For public self-serve installs, attach the support evidence below whenever it applies. Redact anything you cannot share publicly.
+  - type: textarea
+    id: summary
+    attributes:
+      label: What happened?
+      description: Describe the observed behavior and the expected behavior.
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Reproduction steps
+      description: Include commands, API calls, SDK snippets, or config changes.
+      placeholder: |
+        1. Run ...
+        2. Call ...
+        3. Observe ...
+    validations:
+      required: true
+  - type: dropdown
+    id: install_mode
+    attributes:
+      label: Install mode
+      options:
+        - Local/mock provider
+        - Single-node Docker/runc
+        - Docker with gVisor
+        - Docker with Kata
+        - Firecracker
+        - PRoot
+        - E2B/custom provider
+        - Multi-worker/enterprise prototype
+    validations:
+      required: true
+  - type: textarea
+    id: support_evidence
+    attributes:
+      label: Support evidence
+      description: Attach or paste the relevant command output. Use fenced code blocks for logs.
+      value: |
+        - `stacyvm support bundle --output support.json`:
+        - `stacyvm config lint --production --file <config>`:
+        - `stacyvm upgrade rehearse --config <config> --database <db>`:
+        - `stacyvm doctor --production`:
+        - `scripts/certify-runtime.sh <runtime> --format markdown --output <runtime>-certification.md`:
+        - `scripts/verify-release.sh <version> <arch>` or installer verification output:
+    validations:
+      required: false
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: Include OS, architecture, StacyVM version/commit, provider runtime version, Docker/Firecracker/gVisor/Kata/PRoot version, and whether this is CI or a host install.
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs
+      description: Paste redacted server logs, SDK stack traces, or diagnostics JSON.
+      render: shell
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Public support matrix
+    url: https://github.com/StacyOS/stacyvm/blob/main/docs/public-support-matrix.md
+    about: Check supported install modes and required support evidence before opening an issue.
+  - name: Production readiness checklist
+    url: https://github.com/StacyOS/stacyvm/blob/main/docs/production-readiness.md
+    about: Review the current production-readiness gates and known platform requirements.

.github/ISSUE_TEMPLATE/support_request.yml

@@ -0,0 +1,63 @@
+name: Production support request
+description: Ask for help with a public self-serve or production-style StacyVM install.
+title: "[Support]: "
+labels: ["support", "needs-triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Use this form for install, upgrade, runtime certification, and production-readiness help. The public support matrix explains which modes are supported, host-certified, preview, experimental, or planned.
+  - type: dropdown
+    id: support_level
+    attributes:
+      label: Runtime or deployment mode
+      options:
+        - Single-node Docker/runc
+        - Docker with gVisor
+        - Docker with Kata
+        - Firecracker
+        - PRoot
+        - E2B/custom provider
+        - Multi-worker/enterprise prototype
+        - Other
+    validations:
+      required: true
+  - type: textarea
+    id: goal
+    attributes:
+      label: What are you trying to do?
+      description: Describe the target setup, workload, and what production-ready means for your environment.
+    validations:
+      required: true
+  - type: checkboxes
+    id: evidence_checklist
+    attributes:
+      label: Evidence checklist
+      options:
+        - label: I ran release or installer verification.
+        - label: I ran production config lint with the same environment the service uses.
+        - label: I ran upgrade rehearsal before changing binaries or images.
+        - label: I ran `stacyvm doctor --production` on the target host.
+        - label: I generated a redacted support bundle.
+        - label: I generated runtime certification output for host-certified runtimes.
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Evidence output
+      description: Paste or attach redacted output for every checked item above.
+      value: |
+        - Release/install verification:
+        - Config lint:
+        - Upgrade rehearsal:
+        - Doctor:
+        - Support bundle:
+        - Runtime certification:
+    validations:
+      required: true
+  - type: textarea
+    id: blocker
+    attributes:
+      label: Current blocker
+      description: What is preventing you from proceeding?
+    validations:
+      required: true