docs: prepare v2.8.4 release

.github/PULL_REQUEST_TEMPLATE.md

@@ -12,13 +12,18 @@
 
 Release/install scripts, if changed:
 
-- [ ] `bash -n` / `sh -n` and `shellcheck -S warning scripts/*.sh`
+- [ ] `bash -n scripts/*.sh`, `sh -n scripts/install.sh`, and `shellcheck -S warning scripts/*.sh`
+- [ ] `python3 -B -m unittest -v scripts/mirror_receiver_test.py`
 - [ ] Invalid version/tag rejection and static amd64/arm64 builds pass
 
 Workflows, if changed:
 
 - [ ] `actionlint`
 
+Documentation, if changed:
+
+- [ ] Chinese and English user documents remain synchronized and all relative links resolve
+
 ## Safety Notes
 
 - [ ] No real private keys (including the release signing key), invite bundles, hostnames, server IPs, `/etc/shadow` data, or production `authorized_keys` were committed.

CHANGELOG.md

@@ -2,12 +2,30 @@
 
 All notable changes to this project are documented here.
 
-## Unreleased
+## v2.8.4 - 2026-07-27
 
 - Run mirror synchronization only from an explicit protected-`main` dispatch.
   GitHub binds a `release` event workflow to the released tag, so the automatic
   trigger could not satisfy the default-branch trust check and must not receive
   the mirror deployment credential.
+- Restore a genuine 30-second quick start through the built-in official mirror:
+  propagate curl failure with `pipefail`, run the installer as root, and create
+  the first invitation only after installation succeeds.
+- Document the convenience stream's exact first-install trust boundary: it does
+  not authenticate the installer or retract partial script bytes, and GitHub
+  fallback begins only after the installer is running. Retain the commit-,
+  independent-hash-, and exact-release-pinned high-assurance procedure.
+- Align security, contribution, pull-request, and release guidance
+  with mirror-first complete-source downloads, protected-main mirror dispatch,
+  the full script/receiver checks, and the `v2.8.4` release examples. Enforce the
+  approved convenience command and high-assurance bootstrap properties in tests.
+- Refocus the bilingual README files on first-time users. Move detailed install,
+  upgrade, operator, and security behavior into paired user guides while keeping
+  vulnerability reporting, contribution, and release procedures in their own
+  documents.
+- Ignore third-party sudoers drop-ins whose names happen to be valid usernames.
+  Only files in the `linux-temp-admin-` namespace are now inventoried, so
+  `doctor`, cleanup, and uninstall do not report or act on unrelated policy.
 
 ## v2.8.3 - 2026-07-27
 

CONTRIBUTING.md

@@ -8,7 +8,7 @@ The tool lives in `cmd/` and `internal/`, and ships as a signed static Go binary
 
 ## Before You Start
 
-- Read `README.md` / `README.en.md` and `SECURITY.md`.
+- Read `README.md` / `README.en.md`, the paired user guides under `docs/`, and `SECURITY.md`.
 - Do not commit real invite bundles, private keys (including the release signing key), hostnames, server IPs, `/etc/shadow` data, or `authorized_keys` from real systems.
 - Prefer focused pull requests: one behavior change, hardening fix, or documentation improvement at a time.
 
@@ -38,8 +38,9 @@ host.
 **Release/install scripts**, if you touch `scripts/`:
 
 ```bash
-bash -n scripts/release.sh scripts/sign-release.sh
+bash -n scripts/*.sh
 sh -n scripts/install.sh
+python3 -B -m unittest -v scripts/mirror_receiver_test.py
 shellcheck -S warning scripts/*.sh
 ```
 
@@ -54,11 +55,11 @@ For changes that touch account creation, revoke, sudoers, systemd timers, or `at
 - Prefer root-owned temporary files plus atomic rename for managed root files; set owner/mode on the file descriptor and never follow a symlink at the target.
 - Do not silently overwrite an existing installed command if doing so could break another registered user's auto-revoke task.
 - Keep non-interactive automation explicit: dangerous actions need `--yes` plus a specific confirmation value when relevant.
-- Update both Chinese and English README files when user-facing behavior changes.
+- Update both languages of every affected user document when user-facing behavior changes.
 - Add or update tests for validation, parsing, quoting, and safety boundary changes.
 
 ## Pull Request Checklist
 
-- [ ] `build`, `vet` (with `-printf.funcs`), `gofmt`, and `test -race` pass; integration tests pass or are unaffected. (`scripts/` changes: ShellCheck passes.)
-- [ ] README / CHANGELOG updated when behavior changes.
+- [ ] `build`, `vet` (with `-printf.funcs`), `gofmt`, and `test -race` pass; integration tests pass or are unaffected. (`scripts/` changes: syntax checks, mirror receiver tests, and ShellCheck pass.)
+- [ ] README, affected user-guide pair, and CHANGELOG updated when behavior changes.
 - [ ] Security-sensitive behavior was tested in a disposable environment or clearly explained.