chameleon 2.33.0

Changed

• Enforcement now defaults to enforce. A newly bootstrapped or sparse-config
  repo (no enforcement section in config.json) now blocks for real instead of
  running shadow-only. Blocking stays gated: the convention rules
  (naming/import/jsx/file-naming) require per-repo zero-false-positive calibration
  against the repo's own committed files plus a high-confidence archetype match;
  deterministic security facts (hard-kind credentials, eval/exec) block on
  detection; the turn-end idiom review blocks once per session. Every block needs
  a trusted profile, is overridable inline with // chameleon-ignore, and
  CHAMELEON_ENFORCE=0 forces advisory. Set enforcement.mode: "shadow" to
  log-only or "off" for advisory. Existing repos with an explicit mode are
  unaffected; a sparse-config repo flips on its next session with no migration step.