Manifests (UAPK header)

Each request includes a UAPK manifest reference:

UAPK-Manifest: bafybeigdyr…   # content-addressed CID (example)

• The server verifies signature & version, then enforces capabilities and policy.
• Every call writes an immutable Log CID you can audit later.