[RomainROCH]

Tags currently prepare a public release without checking that the tag version, main CI evidence and uploaded executable identify the same candidate. Prepare a verified draft instead, with public publication kept manual.

• Integrate the existing maintenance baseline: development checks/docs, bounded log-tail reads, runtime cleanup and isolated smoke cleanup.
• Include the existing bounded IPC commit 60399554db753cb010a6770e24ec1b8fa2dcae93 from fix: bound control pipe request reads #6. Partial control requests are limited to 4096 wire bytes and one absolute second, preserving status availability and same-user/elevation rules. This PR overlaps fix: bound control pipe request reads #6; that draft remains open for a separate maintainer decision.
• Set the technical candidate version to 0.2.1 across Cargo.toml, Cargo.lock and the manifest. This is provisional and no matching tag or release has been created.
• Require a strict version tag, remote-main ancestry, the exact latest successful push/main CI run and required Windows steps. Recheck the remote annotated tag immediately before draft creation.
• Build and smoke the same MSVC executable, transfer it by immutable artifact ID and verify its hash and build metadata. Keep validation read-only and reserve contents:write for the draft job. Refuse any existing release or draft; never clobber assets.
• Document unsigned status, manual publication and the limits of repository-only guards. No tag rules, credentials, signing service or repository security setting changes.

Candidate: 921755e98256c0e51c2ce851f775323f1bcda18e.

The new fix: use fixed chunks for UTF-16 properties commit adapts the existing Unicode property reader to Rust 1.99 Clippy. as_chunks::<2>().0.iter() preserves complete byte pairs, native byte order, NUL termination and invalid UTF-16 handling.

Smoke preflight now captures an empty process enumeration as an explicit empty array. It still refuses query errors, conflicting runtimes and existing autostart tasks. Seven inert regression cases execute the real getter/caller function definitions without running the smoke runtime.
Assembly: maintenance 39aadd2d9f464305fe545e80d32328cfe9e4c0bf plus IPC 60399554db753cb010a6770e24ec1b8fa2dcae93, merged locally at 742fcaf874dbdfbfd85294eb740e46678341b487. The separate physical-validation worktree is excluded.

Validation:

• Rust 1.99.0 MSVC: fmt, offline/locked check, 62 passing Cargo executions (57 distinct tests), strict Clippy for all targets/features, release build, help/version, actual PE manifest/version and 26 Markdown checks. The Clippy patch tested locally is byte-for-byte identical to its committed diff; the subsequent smoke change leaves Rust sources unchanged.
• Unchanged release tooling was previously checked with 194 release-guard cases under Windows PowerShell 5.1 and PowerShell 7.6.5, developer-tooling/smoke-safety fixtures and nine rejected unsafe YAML variants.
• Seven new smoke preflight cases and the smoke safety suite pass under PowerShell 5.1 and 7. Independent reviews of the Clippy and smoke changes found no blocking findings.
• Hosted Windows CI of this exact SHA: run 37368800824, attempt 2 succeeded. Full, developer tooling, smoke safety, release guards, actual smoke and binary upload all passed. Attempt 1 ended before runner acquisition without executing any step.

Not run locally: the native Power Request unit test, state-changing Windows smoke, live cross-elevation/UAC and physical S3/Hibernate/Modern Standby acceptance. The normal Windows CI includes Full checks and smoke on its disposable hosted runner; its result is recorded above.

The tag workflow has not been exercised end-to-end. A future release requires integration into main and that commit's push/main CI. Older tags carry older workflows, maintainers can remove guards, and tag rechecking is not atomic with draft creation. External tag protection is neither installed nor claimed by this PR.

This PR is intentionally a draft. Merge, tag creation and public release publication require separate authorization.