ci / rust (push) Failing after 2m51s
`PairAttachVerifier` now stores `allow_inbound` behind `Arc<RwLock<_>>` so clones share the same set. Two triggers re-read the unified config file and swap it atomically: - SIGHUP — `systemctl --user reload maestrod`, or any `kill -HUP`. The installer's user unit now sets `ExecReload=/bin/kill -HUP $MAINPID`. - `POST /api/policy/reload` — used by `maestro policy reload`. The CLI reads `[daemon].bind_addr` from the unified config (default 7070) and POSTs to `http://127.0.0.1:<port>`. No PID lookup required. Also adds `maestro policy show [--json]` and `GET /api/policy` for "did my edit get picked up?" debugging. A broken mid-edit config logs an error and leaves the previously-effective list in place rather than locking everyone out. In-flight attaches keep their existing connection — revocation requires killing the session, as spec'd. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>