0.3.1 — ledger, interception and shell rewriting hardened

Fixes the 29 defects found by three read-only audits plus self-review, and raises the suite from 91 to 124 offline tests.

Vault

• Atomic rewrite under a cross-process lock (pid + token; locks from dead processes are stolen).
• Cache keyed by the ledger's stat, so reads and writes always agree with the file.
• An unreadable ledger is no longer mistaken for an empty one.
• A torn final line is repaired instead of fusing the next record.
• scratch_import preserves non-UTF-8 bodies byte-for-byte and refuses to delete the original unless the stored copy round-trips.

Interception

• The shell rewrite only touches program positions; comments, quoted payloads, grep patterns and non-interpreter arguments are left alone.
• Failed or malformed tool results are never annotated as success.
• Pending rewrites are bounded and expire.

Classification

• An already-existing file is always kept, so deliverables can be iterated in place.
• protectDirs / scratchDirNames match case-insensitively on Windows.
• Glob matching is segment-wise dynamic programming: no exponential backtracking.
• Distinct source names never collide after sanitising.

Lifecycle and prompt

• enabled: false really disables interception, prompt injection and purge.
• The shell-root probe is time-bounded and negatively cached.
• Config warnings surface, and unset variables no longer produce literal paths.
• The discipline prompt adapts to the capabilities actually registered.