Harden v4.4 participant supply chain

[Ohjjam]

Summary

• add canonical Ed25519 threshold authorization and target sequence anti-rollback checks
• require recovery-root cross-signing, custody/controller independence, and pinned finalized anchors before write participation
• publish a read-only participant bundle and installer that creates no wallet, task, background process, or workspace write
• keep write mode fail-closed while v4.4 public-write gates are pending

Verification

• node --test tests/v44-supply-chain.test.mjs tests/v44-autonomy-safety.test.mjs tests/v44-public-discovery.test.mjs (20/20)

[Ohjjam]

Superseded by #24, which contains the complete reviewed and verified v4.4 candidate merged into main.