[Sunrisepeak]

Platform 0.23.3 selects the corrected Linux read-only confinement graph for both ok images and the hosted arrangement. Linux 0.24.1 requires Landlock ABI 3 before reporting confinement support, so truncation is constrained for a read-only grant. Its ABI probe cache uses atomic accesses. All four image packages are 0.4.3 so the native runner includes the corrected backend too. Compiler and image behavior otherwise follow platform 0.23.2.

The group pins Linux 0.24.1, musl 0.27.3, llvm-runtime 0.18.4 and image 0.4.3. All prerequisites have completed producer CI, immutable source releases, byte-verified GitCode mirrors and public-index publication. The runtime passes all ten producer jobs. The platform's package manifest, image/hosted layers, carrier, tools and version table all agree on these exact releases. mcpp remains required at 2026.11.3.1 for std-module compile flags.

Bootstrap order follows the existing exception in mcpp-community/mcpp#885:

1. Verify all prerequisite public index archives from GitHub and GitCode.
2. Test this source platform locally, tag 0.23.3 at the reviewed PR head, then mirror and index that exact source archive. Only the index candidate checks that reject its old mcpp against the required floor may use the documented bootstrap exception, after every failure is inspected.
3. Complete os 0.2.9's public-index matrix and publish/index it. Update the mcpp candidate's built-in platform and launcher dependency to this final group.
4. Require all four platform CI hosts to pass before merging this PR. Keep the immutable tag on its original reviewed head; verify the merged tree matches and update openkal-0.23 with a lease.

CI uses the existing temporary MCPP_SOURCE_REF=release/2026.11.2.3, whose product version is 2026.11.3.1, until that engine is installable. Earlier tags, archives and index entries remain unchanged. Full final consumer qualification and native tool binary publication remain separate gates.

The prerequisite runtime index is now verified at public commit 24b40f77443511401916368eac0a07aa903af317: both archive downloads have SHA256 9c63d881e48860a46ffb2df2cfdeebe871bd6b8c8e0bf4b009c40409ba89ebc6 (664,148 bytes), and all three runtime 0.18.4 source entries have the expected digest. After a real index refresh, local mcpp test -v passes with this platform source and the public released dependencies: one x86_64 image executes, one aarch64 image builds and is explicitly not run on the x86_64 host. No working-tree substitution is used for the dependencies.