hotato 0.8.0

Fixed

• hotato connect crashed on Windows with AttributeError: module 'os' has no attribute 'fchmod' when storing credentials. os.fchmod is POSIX only;
  tempfile.mkstemp already creates the file owner-scoped, so the call is
  now guarded. Found the same hour by the new cross-OS CI matrix, on its
  first run.

Added

• Fresh-capture provenance guard for hotato fix trial: every run
  envelope now records an audio_provenance block per event (a streamed
  sha256 of the exact audio bytes scored, plus sample rate and frame count;
  additive, schema_version stays "1"). hotato fix trial compares this
  identity, before vs. after, for every fixture the improved claim rests
  on: an identical digest (the after run re-scored the SAME recording the
  before run scored, just under a different threshold) downgrades the
  verdict to refused (the same exit code 3 hotato apply's own refusal
  uses); a digest missing on either side (an older envelope, or one built by
  hand) downgrades to inconclusive, never assumed fresh. Distinct, known
  digests proceed exactly as before. Closes the exact forgery path where the
  same recording is rescored with a looser threshold and passed off as a
  verified fix. See docs/FIX-TRIAL.md#fresh-capture-provenance-guard-a-re-score-is-never-a-fix
  and docs/RECAPTURE.md#how-hotato-tells-a-recapture-from-a-re-score.
• Report-facing claim-language cautions: hotato contract verify now
  prints, in every text and HTML render, "This result re-measures stored
  evidence. It does not test the current agent." hotato fix trial's
  audio-provenance section now prints a matching provenance/revision
  caution wherever that section renders (an improved verdict, or a
  refused/inconclusive one the fresh-capture guard itself downgraded).
  Both strings are drawn from a new claim-language table -- which evidence
  you have, what it accurately lets you say, and the common overclaim it
  does not support, for five levels of evidence from a historical contract
  alone up to a production rerun after deploy -- and new audio-handling
  rules covering what raw call audio may contain, why redaction does not
  remove spoken content, and an audio-free evidence summary to prefer when
  sharing proof without the recording. See
  docs/RECAPTURE.md#claim-language-what-each-kind-of-evidence-lets-you-honestly-say
  and SECURITY.md#audio-handling.