attestload v0.4.0

Attest-before-load gate for coding agents: sign Skills / MCP servers into verifiable SBOM + provenance, and refuse to load unattested code.