Operator reported 4 vCPU / 16 GiB; verify shows guest still 2 / 3.8 GiB
after recent reboot. Document check report and keep open thread until
nproc/free match the new flavor.
Add close_session helpers and CLI to append vault session logs, engagement-
scoped metrics, duty Kai charges, and client reports. Rejects sensitive
summaries. Pilot smoke-closed once; prepare points operators at close-session.
