After 0.8.0: Protected content #91

Release: After 0.8.0.

Owner: Irzhy (@irzhywau). Planned for after 0.8.0.

Done means

Release acceptance: Each exposed feature works clearly from start to end, including recovery. Keep unfinished or confusing features hidden until their complete journey passes. Hiding a feature does not complete its task; source checks alone do not establish installed acceptance.

• Joining a custody ceremony requires the owner’s approval in Inbox.
• Create, list, buy, open and play work through the shared Runtime approval
  system, and playback survives restart.
• The accepted candidate passes its checks and independent review, with
  dependencies and licences accounted for.
• Cryptographic review (External / PQ cryptographic review of the protected-content contracts and custody crates #48) is complete. Test funds limit economic exposure only. Confidentiality and custody still need External / PQ cryptographic review of the protected-content contracts and custody crates #48, unless the journey is limited to a clearly isolated test-content and test-key scope. Proof: the accepted scope is recorded here before release.

Reuse these existing issues as children: #42,
#44,
#45,
#46,
#47,
#48 and
#49.
Keep their remaining acceptance criteria intact. The separate Lit/CEK design
work remains later. The existing issues below supply the remaining work.

• Keep the stack to protected content: feat(protected-content): buy from any live offer #206 adds a public route (POST /api/apps/marketplace/listing) that needs approval under Required: Isolation as promised #173, and feat(protected-content): a mint that completes and an open that works #205 changes home-gui, wallet, inbox and model-provider; split anything outside protected content into its own reviewed PR. (PR review, 7 Oct)