dsh 0.2.0-rc.2: in-container update (experimental channel), path-agnostic compose, upstream patches adapted to 0.1.x/0.2.x

upstream/container/platform/seed/trust/DEVELOPMENT_FIXTURE

@@ -0,0 +1,2 @@
+This public trust fixture is for local builds and tests only.
+Release workflows must replace it with an offline Recovery-signed seed and reject this marker.

upstream/container/platform/seed/trust/keyring.json

@@ -0,0 +1 @@
+{"current":{"algorithm":"Ed25519","keyId":"67d0eaa2e221472b07bb7e090f13fbc33662f00b1b95b77650aa98fcbfc3917c","publicKey":"MCowBQYDK2VwAyEAloaqTWysQwhw98hQc+bhcd7zjvngnhLw9fjaC8X28Ho="},"generation":1,"issuedAt":"2026-08-19T00:00:00.000Z","next":{"algorithm":"Ed25519","keyId":"1fe144dde06c2525dcf73b50363d051d821d9ddc80f6c2954a0a9a9a23d07cf5","publicKey":"MCowBQYDK2VwAyEAz4DKA6dm2sx/zmQA96MJjJ3xWEIsYZRVLw+ebFc/kAY="},"revokedKeyIds":[],"schema":1}

upstream/container/platform/seed/trust/keyring.sig.json

@@ -0,0 +1 @@
+{"algorithm":"Ed25519","keyId":"e40cdc209514de354c2c1976bf3476ef21753058c73ba9bf373a20f201860fd6","schema":1,"signature":"WXErXfkHnhprgnywUB4ukhizyqqBBBAoxQE9WDN4Q452lz1nm867eBrUsKpMfrh7DE0OU7Z+FN4g1leCEawiBg=="}

upstream/container/platform/seed/trust/recovery-root.spki.base64

@@ -0,0 +1 @@
+MCowBQYDK2VwAyEA2mTS4kmUv3mIxqkJkQc949uZ7mOLtPT2g7iWU7mstRM=