Fixes and improvements, September

Fixes and smaller improvements shipped between August 24 and September 30.

• A deployment whose initial setup or provisioning failed now picks up the next corrective release, and alien refreshes setup before retrying a failed update instead of repeating the same failure.
• Container rollouts on machines now wait for the new replicas to be healthy before an update is marked ready, and old or stale replicas no longer count toward readiness.
• Machines whose credentials were rejected can rejoin, and a join token can no longer be reused for a machine ID that already exists.
• CLI errors now keep the server's error details, list every failed preflight check, and print --json command failures on stderr.
• Structured log messages render as readable text in the CLI and the dashboard instead of raw JSON.
• Log delivery from containers and the manager retries transient failures instead of dropping lines, and log search bounds its queries and reports failed responses.
• Deploying into a fresh AWS account no longer fails on a missing autoscaling service role or an exhausted Elastic IP quota, which is now checked before the network is created.
• Postgres on AWS works in the default VPC, and initial setup asks for explicit subnets instead of guessing.
• Unknown permission sets are rejected before deployment, generated AWS and Azure permission documents resolve their scopes correctly, and explicit permissions on links are kept.
• Remote Operator Kubernetes RBAC now grants only what the enabled operations need, and Remote Operator setup tokens expire and resume the exact installation they were created for.
• Teardown no longer hangs on AWS when a Lambda execution role still holds network interfaces, and Azure teardown keeps track of partially created resources.
• alien destroy works without a local tracking file, retries a failed teardown, and deployments that failed before provisioning can be deleted.
• Helm installs keep their runtime identity across upgrades, EKS uses a proper Kubernetes exec auth block, and wildcard hosts in Kubernetes endpoint routes are preserved.
• On Google Cloud, initial setup resolves default networks and shared vaults, and completes the handoff of compute and PostgreSQL to the runtime.
• Azure Container Apps names stay within Azure's length limit, managed certificates get enough time to issue, and storage lifecycle rules apply only to their own container.
• Remote Sandboxes on Azure now work end to end, and AWS sandbox images are read and deleted by ARN so rebuilds and cleanup succeed.
• The CLI keeps waiting through transient deployment read errors and manager hiccups, and retries transient registry uploads.
• Local builds and alien dev no longer stall on verbose output, enforce container health checks, and reject worker images built for the wrong architecture.
• Deployment input secrets are write-only and are redacted from diagnostics.
• Containers on machines receive their entrypoint arguments, and ingress keeps working on Google Cloud machines that share a host port.
• The AI gateway sends valid requests when translating to Anthropic, routes Databricks models correctly, and accepts reasoning effort none.
• Dashboard sign-in now shows OAuth failures, workspace invitations survive the OAuth redirect, and viewers can no longer make changes.
• alien vault --deployment works when the flag comes after the subcommand, and setting telemetry off is honored by the manager's logs.