Reference environment and installation prerequisites

Use a NEW disposable Ubuntu 24.04.5 LTS aarch64 host: 2 vCPU, approximately 2 GiB
RAM, no swap, local ext4 storage, at least 5 GiB free before setup, cgroup v2 and
systemd. The observed kernel was 6.8.0-142-generic, systemd 255, glibc 2.39.
Required runtime checks: CPython 3.12.3, SQLite 3.45.1 and venv pip 24.0.
A stable trusted host clock is required. Newer patches, x86_64, macOS, other
distributions and other storage profiles are not qualified by this trial.

Supply sudo, useradd/userdel/groupdel, systemd-run, Python venv, tar, SHA-256 tools
and an already trusted Minisign verifier. This package does not bootstrap trust
in those tools. Do not download a verifier from an untrusted package and then
use it to establish trust in that same package.

Installation needs owner-authorized administrative access to create five distinct
non-login UIDs and protected directories; seal a runtime; and orchestrate child
processes under their UIDs. Review INSTALL.txt, WALKTHROUGH.txt and
records/ROOT-OPERATIONS.json before root execution. Root, the OS and the service
UID are trusted. This is not containment against a malicious administrator.

The operator obtains the OS/image and Python/venv packages from their OS source.
The package then downloads nine exact wheels directly from official
files.pythonhosted.org HTTPS URLs, with mandatory hashes and no index resolution.
Internet access is needed at installation time. Do not substitute versions or
bypass TLS, hashes, runtime checks or resource constraints on failure.

Use new, separate, non-nested home/state paths beneath root-owned parents that
are not group/world writable; an unused account prefix; and unused transient
scope names. Keep Unix socket paths at most 100 bytes. No existing EZA service,
account, grant, domain or installed runtime is needed. A failed partial setup is
evidence to preserve; it is not permission to rerun setup over existing state.

The full scripted acceptance needs an untouched revision-zero domain. Running
manual examples first consumes its lifetime capacity. Use one acceptance attempt
per fresh domain; never replace or repair a used domain to conceal a failure.