v0.2.38

• A risk config that fails to parse now announces itself in the CLI output and the report provenance instead of silently reverting to defaults
• Config disclosure block above the risk list: config hash, overrides active, every suppressed symbol with its reason, ranking exclusions, and switch state — a tuned report can no longer pass as clean
• reclassify overrides now implement auth / payment / pii / none (previously only none had an effect)
• The input fingerprint includes the risk config hash: same commit + version + config = same ranking, one hash
• The irreversible worklist searches the full ranking for destructive paths, not the top 200
• Scoring formula, evidence tiers, proof oracle, and compile gate unchanged; Temporal top-20 byte-identical to 0.2.37