v0.2.22.

Fixed

• Snapshotter-Independent Image Recovery: When both Docker overlayfs extraction and containerd's native snapshotter fail, NineDeploy now exports the image filesystem directly from its OCI registry and imports it under a fresh single-layer chain ID.
• Verified Recovery Tooling: The emergency registry client is pinned to an exact upstream release and its Linux amd64/arm64 archive is checked against a built-in SHA-256 before execution.
• Runtime Metadata Preservation: Direct recovery retains environment, entrypoint, command, working directory, user, stop signal, exposed ports, volumes, labels, on-build instructions, and healthcheck configuration.

Added

• Real MySQL Recovery Smoke: pnpm docker:smoke-registry-recovery exports mysql:8.4 without a containerd snapshotter, imports it under an isolated test tag, starts it, waits for mysqladmin ping, and removes only its exact smoke resources.