perf(systemd): run enable_and_start off the event loop (#1054)

enable_and_start is declared async but its body was entirely
synchronous D-Bus round-trips (is_service_enabled, enable,
is_service_active, start). Each VM start blocked the asyncio event
loop for ~4 round-trips; on a busy CRN this stacks and shows up as
multi-second TTFB on unrelated HTTP requests during allocation
bursts. Same shape as the monitor_payments sweep fix in #963.

- Extract _enable_and_start_sync with the sync body.
- Make enable_and_start await asyncio.to_thread(_enable_and_start_sync).
- Add a threading.Lock around _connect so the payment monitor worker
  (already off-thread via #963) and the enable_and_start worker cannot
  race on close+reopen of the shared SystemBus. Individual D-Bus calls
  go through dbus-python's own per-connection locking.
- Add two tests: enable_and_start actually runs on a worker thread,
  and exceptions from the sync body propagate to the async caller.

feat(auth): source authorized allocation signers from settings aggreg…

…ate (#968)

The Aleph-EIP191-V1 scheduler auth path previously read the authorized
signer allow-list only from settings.AUTHORIZED_ALLOCATION_SIGNERS, which
defaulted to empty — so the signature path was effectively off until each
operator configured it by hand.

Resolve signers through three layers (override > aggregate > default) in
get_authorized_allocation_signers():

- AUTHORIZED_ALLOCATION_SIGNERS (local override): when non-empty, used
  verbatim and nothing else is consulted, giving operators an immediate,
  network-independent way to rotate or revoke a scheduler key even if the
  aggregate's owner key is unavailable.
- The network settings aggregate's authorized_allocation_signers key:
  when non-empty, lets the foundation rotate the scheduler key network-wide
  with no CRN redeploy. Replaces the built-in default.
- DEFAULT_ALLOCATION_SIGNERS (built-in): ships with the official scheduler
  address so a fresh CRN trusts it with zero configuration on day one and
  stays reachable if the aggregate is down. An empty aggregate list is
  treated as "no opinion" and falls back here rather than authorizing no
  one, so a stray empty publication can't brick scheduling.

The boot-time summary log is updated to reflect that signers are
aggregate-sourced (with a built-in default) when no local override is set.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

status: fix egress check and add hostname-based HTTP probes with fall…

…back (#938)

pool: stop and remove orphan controller services on supervisor startup (

#933)

Forgotten VMs left behind stale controller.json files and sometimes
  running aleph-vm-controller@<hash>.service units with active qemu
  processes that kept consuming host RAM. The admission check iterates
  pool.executions and did not see these orphans, so the host's real
  free memory was lower than the check computed.

  On load_persistent_executions, scan EXECUTION_ROOT for controller
  configs whose vm_hash is not in the pool, stop_and_disable the
  matching systemd service, and delete the config file.

Fix: Graceful QEMU shutdown escalation to prevent disk corruption (#925)

* Fix: Graceful QEMU shutdown escalation to prevent disk corruption

QemuVM.stop() previously sent an ACPI powerdown and returned immediately,
leaving the 30s systemd SIGKILL as the only fallback. A SIGKILL terminates
QEMU without flushing disk caches, which can corrupt qcow2 metadata and
guest filesystems (e.g. missing kernel files after an in-guest apt upgrade).

The new shutdown sequence:
  t=0s   ACPI system_powerdown (guest handles clean shutdown)
  t=50s  QMP "quit" (QEMU flushes block device caches and exits)
  t=60s  systemd SIGKILL (last resort)

* qemu: wait for process exit after QMP quit before returning from stop()

---------

Co-authored-by: Ali EL BROUDI <ali.elb@gmail.com>

Reload haproxy at each upgrade to apply haproxy changes (#923)

Fix: Update domain mapping on instance allocation and aggregate chang…

…es (#922)

Domain mapping was only updated on supervisor startup and manual
  triggers. New instances created via allocation had no domains in the
  HAProxy map files, and domain additions/deletions on already-running
  instances were ignored until a manual update or restart.

  - Call update_domain_mapping after successful notify_allocation
  - Listen for "domains" aggregate messages on the WebSocket and
    trigger HAProxy map update when the sender owns a local instance

add new workflow to build and create release on new tag event

add new workflow to build and create release on new tag event

fix: put total cap on requests to CCNs (#876)

Added a semaphore to put a limit on the total number of concurrent
requests to the CCN. This avoids thundering herd failures caused by rate
limiting and reduces the pressure on the CCN.