testpds: model applyWrites deletes the way the reference PDS does

docs(spaces): three tiers and a hold-only space, recorded as the direction to research

appview: serve the OCI API with cuelabs ociregistry and drop distribution

appview: drop the bcrypt fallback for device secret authentication

minor bugfix in wrangler, add permissioned data research

first pass at implementing a label service

major refactor to implement usercontext

lexgen work

trusted platform poc

try and fix bad oauth cache

test tag push

actually add scanner implementation