v2.4.0-rc1 — Sentinel + Fleet

Adds airlock sentinel (persistent repo-level governance, independent of airlock run) and airlock fleet (control plane: Sentinel enrollment, Ed25519-signed policy distribution, revocation, session history across restarts). Local governance continues even if the Fleet control plane is unreachable or the Sentinel's credential is revoked. See progress.md (dev-only) and CHANGELOG.md for detail. This release also fixes release-artifact naming so scripts/install.sh and go install reliably pull current code — the previous release (v2.3.0-rc1) predated Sentinel/Fleet entirely.