Release v4.28.0

Changed

• Stage refuses to render a model whose @pii or @sensitive concept is used as an event-source identity (a command identifier, a projection key or a for destination), with STAGE-CRATIS-COMPLIANCE-001, before writing any output. Chronicle does not allow personal data as an event source id. @pii on other concepts still renders as [PII]. (part of #197)
• The "Rendering N application(s)" message is printed after the model has been read, and is not printed when the event model is invalid. (#187)

Fixed

• Rendered command handlers append each produced event to the event source named by its for, instead of always using the command identifier, and the rendered specifications check each event on that same event source. Productions without for are unchanged. (#187)