Isolated release control
Checking this Claw update…
The release runner is proving the exact sealed version.
One-time browser enrollment needed
Copy this public enrollment value, then install it with the root-owned bootstrap command. The private key never leaves this browser origin.