Conflicts resolved toward the branch: PM owns dependency preparation, the Windows shim re-exec/hand-off path stays retired (main's shim-parent wait, gateway-resume env token and update_cmd_deps tests dropped), docs describe the PM update flow. The docker workflow parks install-stamp.json around the toolchain step instead of deleting it so tests/docker can compare provenance.