Validate v1.1 on macOS Docker Desktop

[BrettKinny]

This was generated by AI during triage.

Type: HITL

What to build

Run the v1.1 lifecycle and upgrade path on a real macOS host using Docker Desktop, including paths with spaces, SSH forwarding/fallback, timezone fallback, state reuse, and safe purge behavior.

Record the Candidate version, source SHA, image digest, macOS/architecture, Docker Desktop version, shell, install paths, and pass/fail evidence in this issue.

Acceptance criteria

• Fresh install, launch, setup, rebuild, uninstall, and purge succeed on a path containing spaces.
• A retained v1.0 Managed home upgrades through explicit adoption without losing authentication, history, or selected tools.
• SSH-agent forwarding works and the private-key fallback remains read-only.
• A host without a bindable /etc/localtime uses the documented timezone fallback without blocking package setup.
• The portable SHA-256 and exact Sigstore identity verification commands work with stock macOS tooling plus documented prerequisites.
• Managed config refresh preserves user edits and rejects unsafe symlink destinations visibly.
• Rebuild and purge preserve or remove only resources recorded by the Install identity, including custom Workspace and Managed-home names.
• Results and any failures are attached here and the v1.1 manual UAT checklist is updated.

Blocked by

None - can start immediately.