clawock v0.1.2

Install from PyPI:

python -m pip install clawock==0.1.2

Mostly documentation and repository policy. It is a release because README.md
is shipped verbatim as the PyPI long_description, and a published page cannot
be re-rendered — the same reason 0.1.1 existed.

Fixed

• The numeric provenance advisory now recognises %, pp, x/× and σ, and
  matches context per unit rather than against one flat set of numbers, so a
  figure like 2.3x is no longer waved through by a match on an unrelated
  quantity. The intraday insights sidecar is normalised before publication:
  model-owned narrative is kept, the generated_at stamp is the harness's own
  UTC clock, and a missing or malformed sidecar stays warn-only so report
  delivery is not held hostage to it. (#485)
• The README's widest claim about the system — "26 fetch and compute modules
  across 8 layers" — had no artifact behind it and had survived #429, which
  moved every module it counted. The catalog is now
  config/information-layers.json: every packaged command sits in exactly one
  layer or on an exclusion list with the reason it is not information
  collection, and the tables in both READMEs are checked against it. The
  partition covers both distributions' command registries, so nothing counted
  can be typed by hand. Re-derived, the count is 39, and two layer names that no
  longer described their members were corrected. (#476)

Added

• SECURITY.md naming GitHub private vulnerability reporting — now enabled on
  the repository, so the channel it points at exists — a
  CONTRIBUTING.md stating which parts of the repository can accept a patch
  (the package can; the live book cannot), and a bug-report issue template.
  Installable packages need a disclosure channel; a repository someone only
  reads does not. (#477)
• The runtime-coupling ratchet now also enumerates shell entry points naming the
  live host, against a per-file allowlist with a reason each. Its Python count
  stays 0, and the claim now states what it covers. (#478)