WCAB 0.42.0

WCAB 0.42 adds a deterministic standards-form protected-range security-descriptor transition.

The pair changes only one nested protectedRange/securityDescriptor text node in xl/worksheets/sheet1.xml while worksheet protection, a locked target, range shape, legacy verifier, formulas, calculation properties, and every other package member remain fixed.

It adds the protected_range_security_descriptor_changed fact, a bounded raw-OOXML validator, package-isolation and corruption checks, and a privacy-preserving FormulaFence adapter contract. The adapter requires high-severity protected-range permission evidence and FF022 with equal redacted range profiles plus security_descriptor_material_changed=true; it never depends on descriptor, range-name, verifier, or identity values.

Validation: 280 tests passed; ruff and package checks passed; fresh wheel and sdist installs validated all 59 cases and reproduced the canonical manifest. FormulaFence 0.224.0 matched all 60 mappable facts, all three coverage expectations, and all five targeted lint expectations.