v0.4.3 — clarity release

A clarity release: no new features, no API changes. A repo-wide audit rewrote the
docs around a single quickstart, redrew the architecture diagram, and fixed the
places where the docs described something the code does not do. It also found two
CI gates that had been passing without checking anything.

Operators upgrading: nothing to do — no schema, config, or interface changed.

Maintainers: the CI merge gate collapsed five single-command jobs into one
gates matrix, so the required status checks on main must be renamed from
govulncheck/staticcheck/gitleaks/licenses/license-headers to
gates (<name>). Until that is applied, a pull request waits forever on contexts
that no longer report. See RELEASING.md, "Repo settings".

Fixed

• The nightly live e2e jobs were passing while their assertions failed. Both
  steps pipe make into tee to capture evidence, but GitHub's implicit shell has
  no pipefail, so the step took tee's exit code. These are the jobs that prove
  the L0 egress boundary, the metadata block, and the kill cascade.
• make dco accepted any non-empty sign-off, including Signed-off-by: nobody —
  the format assertion was lost when the check moved to git's trailer parsing.
• The README claimed gVisor/CC2 is your default barrier. pick_policy checks for
  a configured model first, so a gVisor host running a model gets a CC1 floor. All
  three outcomes are now stated.
• docs/ENV.md documented an admin-token default that does not exist, so a
  reader who set only WARDYN_TOKEN got an unauthenticated control plane: the real
  default is empty, and an empty token with no OIDC on loopback auto-enables no-auth
  local mode. Both the binary and compose defaults are now stated.
• The compose README described the make setup menu backwards, and told readers
  team/SSO was "coming soon" where the roadmap says it is not scheduled.
• Example scenario commands now run as written (--policy, wardyn run list,
  wardyn deny, and a policy file that actually parses).
• The Helm docs quoted three different, all-wrong chart versions.
• Three API payloads emitted null where they had emitted [], one of them a live
  response body.

Changed

• The console's default sizing is back to 100%. 0.4.0's 17.6px root font token is
  16px again, the sizing that shipped through 0.3.1. The px→rem text-utility
  conversion stays — those values were computed against a 16px base, so each reproduces
  its original size — and --font-size in ui/src/styles/theme.css remains the single
  knob for anyone who wants the larger console back.

• Docs consolidated and de-duplicated (repo-wide audit). The quickstart is told
  once (README → docs/TRY-IT.md); docs/FRESH-START.md,
  docs/ADO-GIT-BROKER.md and docs/TEST-GAPS.md are gone (the troubleshooting
  table moved into TRY-IT); pre-0.4 release notes live in
  CHANGELOG-ARCHIVE.md; new docs/README.md index.

• Diagrams redrawn and gated. The system-overview diagram has no edge
  crossings and is inlined in the README (the stale architecture.png is gone);
  make diagrams now label-checks the diagram side too and enforces a style guide.

• Doc accuracy fixes. The default-barrier claim now states the CC1 fallback on
  runsc-less hosts; ENV.md documents the real (empty) admin-token default and the
  no-auth local-mode consequence; the compose README's setup-menu note was inverted;
  example TASK.md commands run as written.

• Build plumbing. make release-check is now a strict superset of make ci;
  make help is self-documenting; the nightly uploads real e2e evidence; screenshots
  are freshness-gated and the README hero shot is script-captured.