v0.2.8.0 — changelog + version lockstep bump

README.md

@@ -2,7 +2,7 @@
 
 **Self-hosted update management for operators who own their stack.**
 
-`v0.2.6.8` — June 2026 · MIT License
+`v0.2.8.0` — June 2026 · MIT License
 
 > **You're early — over 1,000 of you cloned this before it was announced.**
 > A stable release is coming soon, bringing Windows support back fully gated.
@@ -162,6 +162,9 @@ Before a package is installed: the agent fetches the expected SHA-256 from the s
 - Metadata pipeline: CVE details, upstream intelligence, package provenance
 - Auto-discovery bridge (Repology, container registry, exact match)
 - Agent self-update via privileged helper (zero agent sudo)
+- Binary self-update (agent, helper, desktop) through the same signed, hash-pinned capability-token gate as package installs
+- Process explorer: on-demand /proc scanning (sockets, capabilities, namespaces) with inode correlation
+- Setup accepts an operator-supplied signing keypair — bring-your-own-key deployments
 - Reversible token encryption with one-liner restore
 - Real-time heartbeat and rapid polling
 
@@ -251,6 +254,10 @@ I am a Systems Architect with 25 years on the frontier. I build sovereign agent
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history. Recent highlights:
 
+**v0.2.8.0** — Process explorer, self-update capability tokens, BYO signing keypair at setup, cross-compile CI matrix (linux-arm64, windows-amd64, darwin-arm64).
+
+**v0.2.7.1** — CI/CD pipeline on Gitea Actions with release gate and guided release script. Screenshot capability survives self-upgrade.
+
 **v0.2.6.8** — Dark/light tray app theme, desktop tray spine, prototype Tauri desktop app.
 
 **v0.2.6.5** — Windows agent service logs now write to `C:\ProgramData\RedFlag\logs\agent.log`.