v1.19.7 - Deferred MCP guard reliability and provenance fixes

Fixed

• MCP full-guard deferred runs now expose liveness and complete reliably on large external repositories
• Installed-artifact invar guard smoke runs no longer fall back into local worktree builds during uv/uvx respawn

Included

• asyncio subprocess execution for deferred MCP guard runs
• running-state heartbeat via updated_at
• external full-scan validation against tasca
• wheel/sdist provenance regressions and release smoke coverage