v0.1.0: ptrace backend, signed ledger, stdlib verifier

First release.

• Tracer (Rust, ptrace): records a Linux process tree's file writes, creates, deletes, renames, links, metadata changes, shared writable mmaps, socket connects, binds, listens, sends, DNS questions, execs, forks and exits into events.jsonl, one canonical JSON line per event, each chained by SHA-256 to the previous one.
• Two modes: --mode full stops at every syscall; --mode seccomp traps only the effect syscalls (1.2x to 1.7x overhead on the four benchmark workloads, against 5x to 311x for full ptrace).
• Signed checkpoint (Ed25519) over the chain head; coverage verdict (complete, partial, failed) recorded inside the chain with every reason.
• verifier/verify_ledger.py: 300-line standard-library Python verifier with its own Ed25519, exit codes 0 intact, 1 tampered, 2 unreadable, 3 intact but incomplete coverage; tamper suite covers edit, delete, insert, reorder, truncate and re-signing with a foreign key.
• Benchmarks in bench/: 20 of 20 seeded bypasses caught in full mode (19 of 20 in seccomp mode, where io_uring is denied but not logged), 0 undeclared events over 30 clean runs of a toy agent, overhead tables. All published runs are aarch64 Linux in a container.
• Known limits are listed in the README (mmap stores, mount namespaces, inbound connections, fd passing, xattrs, DNS over TCP).

Install: cargo install --git https://github.com/YusefSyed/effect-tracer --tag v0.1.0 --locked