## 1. Operator CLI

- [x] 1.1 Add strict private YAML and standard-input configuration to worker installation
- [x] 1.2 Add the bounded watch alias over the existing attach control stream
- [x] 1.3 Add an executable native Linux package-root launcher

## 2. Platform Documentation

- [x] 2.1 Create separate copy-paste cheatsheets for Windows, native Linux, and Docker
- [x] 2.2 Update the general quickstart and operations runbook and remove routine cap-zero guidance

## 3. Verification

- [x] 3.1 Add focused CLI, package, YAML-security, and documentation tests
- [x] 3.2 Build fresh Windows and Linux/Docker artifacts and verify install, start, status, attach, watch, and clean stop
- [x] 3.3 Run focused tests and strict OpenSpec validation and record the checked command matrix