复用现有 k3s 调度和 Job 生命周期，增加 worker 接入与批准、受保护节点身份、归档传输、持久迁移锁及活动 PVC 切换；同步管理员 API、CLI、面板和隔离规则。分布式模式默认关闭，保持单机兼容。

验证：Go 全量测试与 vet；面板 874 个测试、lint/build；Linux VM 安装器测试、清单服务端 dry-run、网络命名空间防火墙实测。A/B/C 三机 WireGuard、Velocity 和迁移验收仍待完成。

首次源码安装或旧发布版升级时，等待新二进制构建完成后调用 node firewall；worker 的源码安装也按所请求的版本重新构建。补充安装顺序回归检查和 main 接入说明，更新单机默认与多节点运维边界。

验证：Linux VM 上 bootstrap shell 测试全量通过；go test ./cmd/felis；shell 语法和 git diff --check。

迁移 CLI 不再遮蔽 BeginMigration 的错误，拒绝启动时正确返回失败。规范节点批准错误文案和归档 HTTP 状态常量；tar.Reader 已将旧普通文件类型归一化，无需引用已弃用常量。

验证：CI 固定版本 staticcheck 全量通过；cmd/felis、archivetransfer、backup、distributed 的 go test -race 通过。

Configure connection and storage before creating or resuming the one-time Owner login. Remove Minecraft prerequisites from setup and preserve established login credentials.

Let staff preview and confirm roles from configured authentication sources using the existing account-link storage and game UUID mapping. Retain in-game code proof for players, add client-version and lobby guidance, and support NodePort passkey origins.

Use shared action buttons and default to the login space. Allow staff to save startup-only experience settings while running and request a durable restart through the existing operator flow.

Grant the API PVC list permission needed to detect retained worlds before server creation, and show internal failures with a request ID. Cover permission, maintenance, restart and UI behavior with regression checks.

Manage Yggdrasil providers from the panel using durable platform settings, protected identity namespaces and atomic revisions. Apply changes to subsequent logins and profile lookups without restarting. Return operator-host logouts to the login method selection page.

Stages lint/test/build/security/deploy/release/pages. Mirrors the commands of
.github/workflows/ci.yml (gofmt, go vet, staticcheck, go test -race, pgint on
PostgreSQL 13/18, shellcheck + bootstrap tests, promtool, panel suite, Java plugin
and mod gates) and adds JUnit/Cobertura reports, DinD image builds pushed to the
container registry, CE SAST/Secret Detection/Container Scanning, govulncheck,
review/staging environments, Releases via release-cli with CHANGELOG sections,
generic package uploads of the felis binaries on tags, and GitLab Pages docs.

GitLab-only commit; not part of the GitHub history.

Bug and Feature issue templates, a default merge request template, CODEOWNERS
(@flyemoji, the group's maintainer account) and .gitlab/changelog_config.yml for
GitLab's changelog API (Changelog: trailers).

GitLab-only commit; not part of the GitHub history.

Conventional commit subjects grouped by type per tag (v0.1.0-rc1 ... v0.2.0) plus
Unreleased. Generated from the actual history; no entries were written by hand.

GitLab-only commit; not part of the GitHub history.

- gotestsum v1.13.0 / gocover-cobertura v1.5.0: v1.12.0 pulls golang.org/x/tools v0.19.0,
  which does not compile with Go 1.26 (tokeninternal).
- plugins/mods: install curl (plugins/test.sh downloads its pinned jars).
- docker-build: push with buildx (--provenance=false); the docker push of the
  containerd-store image index failed with "blob unknown".
- govulncheck: allow_failure, so a new advisory warns instead of blocking.

GitLab-only commit; not part of the GitHub history.