pakka v0.16.0

Review provenance. v0.15.0 proved what diff was reviewed; v0.16.0 proves what the review found. review-pass --findings binds the verdict file's SHA-256 and severity counts into the pass marker; the commit gate re-hashes the evidence at commit time and blocks swapped or mutated findings; the Reviewed-by-pakka trailer permanently records diff and findings digests with error/warning counts in git history; and every bound pass writes a review-verdict audit entry whose rationale text is searchable across sessions via /pakka:recall. Assets CI-built with SLSA provenance attestation, SHA256SUMS, CycloneDX SBOM.