release: 1.0.0-rc.2

[mobileoverlord]

Release staging for 1.0.0-rc.2 — 67 commits since 1.0.0-rc.1 (2026-07-08).

This PR bumps Cargo.toml/Cargo.lock to 1.0.0-rc.2 and cuts the CHANGELOG's [Unreleased] into a dated [1.0.0-rc.2] section (with entries added for everything that had landed without one). Tagging 1.0.0-rc.2 on this commit after merge triggers the release workflow.

Highlights since 1.0.0-rc.1

Features

• Inter-extension dependencies (depends_on) — closure-aware fetch/install/lock/stamps/runtime-ordering end to end, with --locked for CI. Hardened through six review rounds (23 confirmed findings fixed, each with a regression test).
• avocado sbom — SPDX 3.0.1 JSON-LD of installed packages, feed-pinned and reproducible under SOURCE_DATE_EPOCH.
• Device-tree overlays — compiled and delivered during avocado build via per-BSP hooks (on-device verified: Jetson Orin Nano, rpi5).
• Container Dev Mode — host CLI + embedded registry + VM push path.
• VM seed sync — vm update migrates Avocado state through a read-only seed the guest adopts at boot; user data survives updates (pairs with avocado-vm 0.4.0).

Reproducibility / OTA correctness

• AVOCADO_OS_BUILD_ID = content hash of the assembled work tree (shared rootfs/initramfs derivation); permissions, overlay, and post_install changes now OTA. Every image re-ids once on first rebuild.
• Overlay contents hashed into install stamps (an overlay edit can no longer ship stale silently).
• cpio + erofs reproducible; package-manager state purged from all images; SOURCE_DATE_EPOCH honored everywhere; permissions provision in stable order (note: auto-assigned UIDs may shift once).

Breaking

• sdk run passes argv literally (audit CI jobs that shelled through it).
• is_version_compatible returns Option<bool> (lib consumers only).

Fixed (selection)

• rootfs/initramfs no longer reinstall on every run; runtime compile: sections count as active and scope to the target; $CC resolves from the cross-canadian bindir (cross-arch CI leg added); pre-release RPM versioning; rpm 4.20 SDK sysroots; target-<name>: overrides everywhere; container stderr surfaced on failure.

Full details in the CHANGELOG diff. Complete commit list: git log 1.0.0-rc.1..rel/1.0.0-rc.2.

Release steps after merge

1. Tag: git tag 1.0.0-rc.2 <merge commit> && git push origin 1.0.0-rc.2 — the tag-driven release workflow runs tests + security audit and publishes.
2. Downstream: avocadoctl update verbose logging #21 (0.11.0) and avocado-vm oxidize avocado cli #5 (0.4.0) are staged and green; avocado-vm's min_cli_version should point at this release once published (open item on that PR).

[Copilot]

Pull request overview

Release staging for 1.0.0-rc.2, updating crate metadata and cutting the changelog from [Unreleased] into a dated 1.0.0-rc.2 section to prepare for tag-driven release automation.

Changes:

• Bump avocado-cli version from 1.0.0-rc.1 to 1.0.0-rc.2 in Cargo.toml and Cargo.lock.
• Add the 1.0.0-rc.2 section to CHANGELOG.md with the release date and summarized entries.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.

File	Description
CHANGELOG.md	Adds the 1.0.0-rc.2 release section and moves release notes out of [Unreleased].
Cargo.toml	Bumps crate version to 1.0.0-rc.2.
Cargo.lock	Updates the locked package version for avocado-cli to 1.0.0-rc.2.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.