v1.5.2 — security + correctness hardening

Remediates an independent validation pass, in full.

Security. Evidence reads in hotato serve are authorized by live workspace registry roots, not content-store presence — closing a boundary where a digest acted as a cross-workspace capability (one workspace could read another's evidence, and orphaned blobs stayed readable). Share-safe Failure Records now reject embedded Windows-absolute paths.

Correctness. Capability routing rejects arbitrary contract_uri, pairs only same-battery/config events, and degrades under-labelled events to engagement_control. Reference-run artifacts are byte-reproducible (deterministic manifest timestamp). Voice Failure Atlas: OS-independent publication gate, honest stored transcripts, footer-only attribution. A fleet trial is approvable only above the evidence floor. Neural runs label their backend in provenance (energy path byte-identical). MCP reports hotato's version with a single canonical tool inventory. The reference kit and shell scripts are pinned to LF.

Every fix was reproduced-then-fixed and independently verified. Full suite green; five honesty invariants held.