[Llewellynvdm]

Adds a read-only hardware allocation review and explicit apply workflow, resumable storage accounting, and shared durable service incidents. Interrupted scans retain completed accounting, published storage stays reserved until a later complete scan accounts for it, and recovery cannot clear a newer concurrent service failure.

Release-Version: 3.3.0

Changes:

• Add getbible resources realign and menu controls for CPU/RAM allocation, filesystem headroom, configuration ownership, capacity evidence, and explicit apply with stale-plan checks, overlap admission, dry-run protection, and honest partial results.
• Preserve deployment-owned caps and explicit endpoint policies. Apply runtime changes through the existing readiness, reload, and drain transactions.
• Resume storage scans in bounded slices with disk-backed queues and inode accounting; retain published and failed-cleanup storage charges until fresh complete accounting covers them.
• Share durable incidents between OnFailure and telemetry, with bounded reminders and recovery based on newer successful execution and fresh completed storage accounting. Timestamp health observations before collection so a slow query cannot clear a newer failure.
• Document configuration ownership, scan freshness, and operating limits. Preserve unread and active telemetry spools.
• Resolve conflicts against current main and include Update Vite and rebuild dashboard assets for 3.2.15 #70's Vite update without reverting any dependency fixes. Merged after Update Vite and rebuild dashboard assets for 3.2.15 #70 (3.2.15).

Validation:

• 82 focused storage, publication, service-alert, and resource tests pass locally, including a regression reproduced against the old recovery behavior.
• Resource realignment and dashboard management CLI tests, ShellCheck, dependency compatibility, and release validation pass.
• Independent review confirms dependency locks, workflows, dashboard manifests, and generated assets exactly match the updated dependency branch.
• All 21 PR checks passed on the final candidate: Python 3.12–3.14 unit/CLI/real nginx, Gunicorn and SSH integration; dashboard browser tests; security audits; native systemd acceptance on Ubuntu 24.04/26.04; and Docker upgrade acceptance on amd64/arm64.