Tighten v5-to-v6 upgrade safety, release installability, provider MSP mode handling, AI cost accounting, metrics flushing, and frontend guardrails for the v6.0.0 GA candidate.
- isolate provider MSP tenant runtimes onto per-client Docker networks - add adversarial proofs for workspace cap races, handoff retargeting, and org-bound agent report retargeting - pin provider deploy proof to start Traefik before tenant network creation