Prepare v0.3.2 release

[joecklau]

Release intent

Merge the validated develop branch into main as the source commit for the planned v0.3.2 source-only release. This PR does not create the tag or GitHub Release.

Included changes

• Make prebuilt image updates metadata-first and extend the image publication contract and documentation.
• Harden Docker Sandboxes control-plane and create recovery, including exact lock and lifecycle handling.
• Improve host-trust cadence and relay supervision, including race handling and fail-closed behavior during provider problems.
• Strengthen Windows process-group and stdio containment and add focused process and promotion coverage.
• Update startup forwarding, configuration examples, troubleshooting guidance, and release-facing documentation.

Validation

• Current develop head 488d52a242199b090dfbacb6bc237e7b96c0bb18 passed Host trust verification and Core runner verification.
• git diff --check origin/main...origin/develop passed locally after refreshing and fast-forwarding the local develop branch.
• The release workflow will test the exact annotated v0.3.2 commit again before publishing.

After merge

Create and push annotated tag v0.3.2 at the resulting main commit, then manually dispatch the source-only Release workflow with the exact confirmation publish source-only release. Tagging and release publication remain separate approval steps.