Merged after recorded-live 1Panel v2 upgrade smoke, app-scoped maintainer validation, and explicit residual image CVE risk acceptance.