Integrate Prism Orion runtime with patched release toolchain

.env.template

@@ -4,6 +4,10 @@
 # loopback-only.
 
 # --- HTTP / WS ---
+# Prism supplies the one shared Solar/Orion native receiver. When set, Orion
+# must verify it before startup and on every readiness request.
+ORION_LSDP_NATIVE_ADDRESS=
+ORION_LSDP_NATIVE_RESOURCE=orion/state
 ORION_LISTEN_ADDR=127.0.0.1:4007
 ORION_INTERNAL_ADDR=127.0.0.1:4017    # /internal/metrics, local diagnostics only
 # B7 (ADR 003 §3.1.6, #89): /internal/metrics exports
@@ -32,7 +36,6 @@ ORION_COMPILER_CACHE_DIR=/var/lib/orion/compiler-cache
 # ZabAuth /validate endpoint, called via ZabGate.
 # Cache TTL bounds how long Orion trusts a "valid" answer for a given jti.
 ORION_ZABAUTH_VALIDATE_URL=http://127.0.0.1:4000/auth/api/v1/tokens
-ORION_AUTH_CACHE_TTL_S=60
 
 # Durable service token (ADR ZabAuth 003 Amendment 3 § A3.3 parts 1/2/5).
 # Orion holds its outbound credential BY POSSESSION of a refresh token and
@@ -216,3 +219,8 @@ ORION_LOCAL_EDITOR_TOKEN=
 # Cosmetic user id stamped on the local operator Identity. Optional; the
 # role (operator) is what gates, not the user id.
 ORION_LOCAL_AUTH_USER=local-operator
+
+# Orion-owned durable global Blue intent (LSML). Empty uses local runtime data.
+# ORION_STREAM_INTENT_PATH=C:/Users/operator/AppData/Roaming/Prism/local-runtime/stream-control.lsml
+# Installed local overlay declaration, read-only. Empty declares no executable.
+# ORION_OVERLAY_APPS_PATH=C:/Users/operator/AppData/Roaming/Prism/overlay-apps.json

.github/workflows/ci.yml

@@ -42,15 +42,10 @@ jobs:
       - uses: actions/checkout@v5
       - uses: actions/setup-go@v6
         with:
-          # Pinned to an exact patch (not "1.26.x") after govulncheck kept
-          # finding 6 stdlib CVEs (net/url, crypto/tls, net/http,
-          # encoding/xml, encoding/asn1) fixed upstream in go1.26.6 but
-          # still resolving to go1.26.5 here — the runner's local toolchain
-          # cache/image apparently pinned an older patch under the wildcard.
-          # Bastion clearance: CLEARED_WITH_CONDITIONS (Orion#336) — DoS-only
-          # CVEs, no RCE/confidentiality/integrity impact, no veto. Bump the
-          # pin again when a newer patch closes a future govulncheck finding.
-          go-version: "1.26.6"
+          # Pin the patch instead of a wildcard. govulncheck found reachable
+          # net/http and crypto/tls vulnerabilities with Go 1.26.6; the
+          # upstream fixes are in Go 1.26.9 (released 2026-10-08).
+          go-version: "1.26.9"
           # cache disabled on purpose (all 8 Go jobs). The setup-go cache
           # never helps on this self-hosted pool: runners are EPHEMERAL so
           # the on-disk Go cache never survives, and the GitHub Actions cache
@@ -288,7 +283,7 @@ jobs:
           fi
       - uses: actions/setup-go@v6
         with:
-          go-version: "1.26.6"
+          go-version: "1.26.9"
           cache: false
       - name: mint Blue-read App token for private Go module fetch
         id: blue-read-app-token
@@ -329,7 +324,7 @@ jobs:
       - uses: actions/checkout@v5
       - uses: actions/setup-go@v6
         with:
-          go-version: "1.26.6"
+          go-version: "1.26.9"
           cache: false
       - name: mint Blue-read App token for private Go module fetch
         id: blue-read-app-token
@@ -370,7 +365,7 @@ jobs:
       - uses: actions/checkout@v5
       - uses: actions/setup-go@v6
         with:
-          go-version: "1.26.6"
+          go-version: "1.26.9"
           cache: false
       - name: mint Blue-read App token for private Go module fetch
         id: blue-read-app-token
@@ -412,7 +407,7 @@ jobs:
       - uses: actions/checkout@v5
       - uses: actions/setup-go@v6
         with:
-          go-version: "1.26.6"
+          go-version: "1.26.9"
           cache: false
       - name: mint Blue-read App token for private Go module fetch
         id: blue-read-app-token
@@ -451,7 +446,7 @@ jobs:
       - uses: actions/checkout@v5
       - uses: actions/setup-go@v6
         with:
-          go-version: "1.26.6"
+          go-version: "1.26.9"
           cache: false
       - name: mint Blue-read App token for private Go module fetch
         id: blue-read-app-token
@@ -490,7 +485,7 @@ jobs:
       - uses: actions/checkout@v5
       - uses: actions/setup-go@v6
         with:
-          go-version: "1.26.6"
+          go-version: "1.26.9"
           cache: false
       - name: mint Blue-read App token for private Go module fetch
         id: blue-read-app-token
@@ -529,7 +524,7 @@ jobs:
       - uses: actions/checkout@v5
       - uses: actions/setup-go@v6
         with:
-          go-version: "1.26.6"
+          go-version: "1.26.9"
           cache: false
       - name: mint Blue-read App token for private Go module fetch
         id: blue-read-app-token

.github/workflows/release.yml

@@ -43,7 +43,7 @@ jobs:
           fetch-depth: 0
       - uses: actions/setup-go@v6
         with:
-          go-version: "1.26.6"
+          go-version: "1.26.9"
           cache: false
       - name: Mint Blue-read App token
         id: blue-read-app-token