refactor: Move Mihoto to system-level v1.0 management

[Pectics]

Motivation

Mihoto v1.0 replaces the former per-user Mihoro layout with a root-owned, systemd-only Mihomo manager. TUN, system service ownership, atomic recovery, verifiable installation, and release provenance are part of the stable product boundary.

Product changes

• Rename and package the CLI as mihoto with system paths under /etc, /usr/local/bin, and /etc/systemd/system.
• Replace user systemd, cron, and proxy-shell behavior with root policy, a hardened Mihomo service, and a persistent systemd update timer.
• Preserve unmanaged Mihomo YAML fields while applying local TOML overrides.
• Publish four x86_64/aarch64 GNU/musl archives with SHA256SUMS, artifact smoke tests, and GitHub build provenance.
• Verify installer and self-upgrade assets before staged, atomic replacement.

pectos audit and remediation

Physical evidence is recorded by commit 67c9f1b on codex/pectos-audit-evidence-20260730.

The Ubuntu 26.04 x86_64 run passed the repository systemd/TUN harnesses, init and idempotent init, permissions/capabilities, reboot restoration, component updates, apply, timer execution, recovery, and final cleanup. It also exposed two honest failures:

• The supplied GUI-exported one-node profile had no standalone DNS settings and did not establish the requested Japanese proxy exit. The documentation now explains that GUI profiles may omit runtime DNS/TUN settings.
• A YAML-valid but Mihomo-invalid update replaced the working config and caused a systemd restart loop.

The P0 has a strict RED/GREEN lineage:

• RED: fa05bc7, 106fbb7, 35a7fff
• GREEN: 2ac52e2, 0f9c0b8, eb601a1

Mihoto now validates staged configuration with the installed Mihomo core before replacement. After restart it verifies both active state and a stable NRestarts counter; failure atomically restores the previous config, resets the failed unit, recovers the old service, and returns non-zero.

The release owner explicitly accepts this post-evidence remediation for v1.0. The physical-host workflow remains available as a manual self-hosted workflow; publication uses the versioned audit decision because the repository currently has no registered self-hosted runners.

Stable release

• Cargo/CLI version: 1.0.0
• Intended tag: v1.0.0
• Release notes: docs/releases/v1.0.0.md
• Stable audit: docs/audits/v1.0.0.md

Verification

Local fixed-toolchain gates on Rust 1.88.0:

• cargo fmt --all -- --check
• cargo clippy --all-targets -- -D warnings
• cargo check --all-targets
• cargo test --all-targets: 54 unit + 5 CLI tests
• cargo test --all-targets --no-default-features: 51 unit + 5 CLI tests
• scripts/check-system-scope.sh
• scripts/check-release-workflow.sh
• scripts/check-v1-contract.sh
• scripts/test-installer-contract.sh
• Workflow YAML parse checks
• cargo build --locked --release; mihoto --version reports mihoto 1.0.0

Remote CI must be green and review threads must be clear before merge. The PR must use a merge commit so the granular TDD and dual-attribution history remains intact.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.