"why": "Demo-spaces canary feasibility (Claude session over the operator tunnel): one read-only inspection of /opt/lchat ownership and the lchat-home unit, to determine whether operators can place sibling binaries post-hardening. They can't (root-owned fixed paths) — which motivated the `lchat install` verb shipped alongside this entry.",
amadan