RuView Release v2050 — HOMECORE runtime hardening

Release v2050 publishes the HOMECORE alpha hardening work merged in
PR #1450 at commit
581af67.

The HOMECORE crates remain versioned 0.1.0-alpha.0. This repository release
does not claim complete Home Assistant compatibility.

Highlights

• Connected committed state changes and service calls to the shared event bus.
• Fixed WebSocket subscriptions to use client IDs and bounded each connection's
  outbound queue to prevent unbounded memory growth.
• Made bearer authentication fail closed when HOMECORE_TOKENS is absent.
• Removed the browser UI's embedded development-token fallback.
• Replaced success-shaped service stubs with executable state-changing
  turn_on, turn_off, and toggle handlers.
• Added authenticated local intent handling at POST /api/intent/handle.
• Made synthetic biometric/demo entities explicitly opt-in.
• Enabled durable SQLite recording by default, correct lag recovery, optional
  ruvector semantic indexing, automation YAML loading, and graceful shutdown.
• Made entity-registry migration write an atomic HA-compatible destination file
  without silently overwriting an existing registry.
• Removed inactive plugin/HAP runtime claims and documented the exact supported
  and deferred capability surfaces.

Validation

• No-default-feature test matrix across the nine HOMECORE crates passed.
• homecore-server --all-features: 21 tests passed.
• Wasmtime plugin feature: 32 tests passed.
• Ruvector recorder feature: 31 tests passed.
• HOMECORE UI: 41 tests passed.
• Clippy passed for the default runtime surface with warnings denied.
• Optimized homecore-server release build passed.
• Diff integrity checks passed.

Security and operational defaults

• Configure comma-separated bearer tokens with HOMECORE_TOKENS.
• --insecure-dev-auth is an explicit development-only escape hatch.
• Synthetic entities require --seed-demo-entities.
• SQLite history defaults to sqlite://homecore.db.
• Unsupported services fail instead of returning a false acknowledgement.
• Missing BFF upstreams return typed 503 upstream_unavailable responses.

Deferred alpha capabilities

• Server-side native/Wasmtime plugin loading.
• A network HomeKit Accessory Protocol server, pairing, and mDNS advertisement.
• Full Home Assistant REST/WebSocket parity.
• Restore-state at server startup.
• Complete device/config-entry migration.
• STT/TTS and satellite voice protocols.

The authoritative capability matrix is
v2/docs/homecore-capabilities.md.

Release page:
https://github.com/ruvnet/RuView/releases/tag/v2050