v0.5.0 — single-pass sweep, fork-free replay

Performance release for the expect/sweep/watch subsystem (#71, PR #73).

What changed

• expect_replay_line parses ledger lines with bash regex instead of 8–11 printf | sed pipelines per line (zero subprocesses per line).
• sweep --once stages the ledger once, records the staged byte offset under the ledger lock, and per SLA-due candidate scans only the live tail appended since staging. A possible mention of the key, a shorter live file, an unterminated staged row, or any read error falls back to the original full replay.
• Replay is now bytewise and identical on every platform; previously a ledger line containing invalid UTF-8 was poisoned on macOS (BSD sed) and passed or skipped on Linux depending on locale state. Emitted text is still truncated to valid UTF-8 (when iconv is available — see follow-up).
• sweep --once is fail-closed: a snapshot copy or live-tail read failure exits nonzero instead of reporting success; temp files are cleaned on every exit path.
• Ledger format, emitted events, hook and ack rules: unchanged.

Measured (macOS arm64, tests/bench-ledger.sh, single observations, before = v0.4.0)

lines	sweep before → after	watch before → after
1,000	32.8 s → 3.4 s	14.2 s → 0.3 s
10,000	285.7 s → 21.7 s	134.2 s → 2.5 s
50,000	1215 s → 96.5 s	551 s → 12.3 s

Verification: frozen copy of the v0.4.0 script (tests/fixtures/sitter.baseline) as an oracle; seven new equivalence/race/cleanup cases; 181/181 on macOS (bash 5 and 3.2) and ubuntu. Windows/MSYS unverified on this lane.

Review: writer Codex (GPT-6 Astra); three independent read-only seats (Opus 5, Kimi K3, Gemini 3.8 Flash) over three rounds; blocking findings 0 at merge. Full record in PR #73.

Follow-ups: ledger compaction design; localise the remaining LC_ALL=C assignments + exported-locale test; equal-or-longer external ledger replacement; truncate_utf8 non-iconv fallback.