* fix(cli): guard live state cleanup * fix(cli): preserve linked paths on cleanup failure * fix(cli): retain gateway ownership through cleanup * fix(cli): keep cleanup planning read-only * fix(cli): skip mutating bootstrap for cleanup * fix(apple): keep identity locks sandbox-writable * docs(apple): clarify identity lock domains
* fix(identity): coordinate SQLite ownership across runtimes * fix(ci): route changed-scope fixture tests