Updater privilege handoff fix

Fix managed updater privilege handoff in 1.0.5

Version 1.0.5 fixes an EPERM failure that could stop a managed upgrade before the application worker started. The updater service now retains CAP_SETUID across process startup so the worker can safely switch to the prismal account. Existing filesystem protections and privilege restrictions remain enabled, and application code runs without effective, permitted, or ambient capabilities.

The release includes recovery instructions for affected 1.0.3 and 1.0.4 installations and a Linux regression that reproduces the original failure and verifies the corrected handoff. Automatic release-history posts and the update page from 1.0.4 are included when upgrading directly from 1.0.3.