ops-exec: trusted executor (E1+E2), Sando refactor, thin macOS driver
sando: WIP — backup automation, events streaming, observability fixes
sando: MVP — daemon, gates, deploy, TUI
sando: scaffold deploy controller (daemon + TUI)