Merge nucleic/upbeat-slate-lemur-7euo into dev

PATCHES.md

@@ -116,8 +116,19 @@ in-tree means the patch can't be lost to a dependency re-resolve.
    (the `cctl login` write path) gains a delete-and-retry on `errSecDuplicateItem`, since the
    now-silent `exists` can under-report an unreadable pre-existing item. Mirrors
    `KeychainOwnedAccess.withoutLegacyKeychainUI` in NucleicCore. Host-side (shipped by a normal
-   `swift build`); `SecKeychain*` deprecation warnings are expected (built with
-   `WARNINGS_AS_ERRORS=false`). Marked `[Nucleic vendored patch]`.
+   `swift build`). The three `SecKeychain*` symbols are formally deprecated but are the only API
+   covering the legacy ACL panel; they're bound directly via `@_silgen_name` (`nucleic_SecKeychain*`,
+   top of file) so the required calls compile without deprecation warnings. Marked
+   `[Nucleic vendored patch]`.
+
+14. **`Sources/Containerization/Vminitd.swift` — configure the gRPC pipeline before the channel goes
+   active.** `Vminitd.init` used the now-deprecated `HTTP2ClientTransport.WrappedChannel.wrapping(
+   channel:config:serviceConfig:)`, which wraps an already-connected channel best-effort and may drop
+   early server frames such as SETTINGS. Migrated to `wrapping(config:serviceConfig:makeChannel:)`,
+   which invokes the transport's `configure` inside the bootstrap's channel initializer — before the
+   vsock channel becomes active. `init` is now `async throws` (the new overload is async); its callers
+   in `VZVirtualMachineInstance` (`start`/`dialAgent`, both already async) and the integration test now
+   `try await`. Marked `[Nucleic vendored patch]`.
 
 ### GUEST-side patches (require rebuilding the initfs — see below)