DocFence 0.44.0

Static package-signature coverage now constrains transforms on direct package-part references. Non-relationships parts are credited only with no transform list or one direct nonempty C14N-only list; empty, duplicate, relationship, and unknown transform lists are aggregate unsupported references.

This remains a bounded static declaration audit, not XMLDSIG transform/digest execution, certificate validation, trust establishment, or Office client validation.