Qualify the relay-free release on real Machines and Cloud #883

Parent

#868

What to build

Produce release evidence that the final artifacts preserve existing workflows, workload availability and independent connections under relay-only networking. Reuse existing tests and qualification runners; this ticket closes cross-environment evidence gaps, not missing implementation from earlier slices.

Acceptance criteria

• Use real release archives and the actual Cloud runtime to enroll a founder, join another Machine, inspect and mutate through shared RPC, stream exec and remote Build upload, and exercise Entry fallback and truthful revocation. Preserve SSH recovery/auxiliary behavior.
• Run ten distinct clients with five streams each; cancel a stream and terminate an independent process without sibling/survivor disruption. Repeated successful and invalid handshakes show bounded retention over a documented sustained run.
• Require outbound TLS relay operation with inbound management traffic blocked; verify no management listener and unchanged kernel WireGuard/workload behavior. Keep public DERP smoke testing small and separate from deterministic private-DERP CI.
• Qualify restart, socket recreation and a bounded upgrade using release artifacts: stable Machine/Tailcat identity, retained pairing/data, continuing application traffic and observed reconnection. Recheck actual Cloud cold/warm execution, deadlines and helper cleanup.
• Rung 4 — register required informing tests in the existing runner. Rung 5 — existing real-Machine archive authority qualification. Report exact artifact/runtime, observed outcomes and remaining failures; do not mark release qualified while any production gate fails.

Blocked by

• Remove the custom relay and its release infrastructure #882