v2.4.0 — M10 post-audit hardening

[danielPoloWork]

M10 — post-audit hardening. The follow-up to a full post-v2.3.0 repository audit: correctness, security, and documentation hardening. No breaking changes, no new user-facing features.

🔒 Security

• Installer tar-slip guard (Installer: reject symlink/hardlink entries with escaping targets on extract (tar-slip) #129). setup.sh / setup.ps1 now refuse any symlink/hardlink entry in a downloaded bundle before extracting — defeating a path-escape via a malicious link target — and the guard runs even under --no-verify.

🐛 Fixed

• UTF-8 stdio on Windows (Tooling: force UTF-8 stdout — crash/mojibake on non-UTF-8 (Windows cp1252) consoles #128). Every CLI tool forces UTF-8 on stdout/stderr, so non-ASCII output no longer mojibakes and the central self-lint no longer crashes on a cp1252 console.
• Defensive hardening of latent edge cases (Defensive hardening in tooling (latent edge cases) #131). Fail-safe guards in risk_score, cleanup_installer, and eados_lint (gate-coverage), plus clean errors instead of tracebacks on bad input across the doctor / eados / phase_runner / traceability / rfc_check CLIs.
• Docs accuracy sweep (Docs accuracy sweep (SECURITY version, translated USAGE 404, contribution spec, RFC M1->M9) #130). SECURITY.md version, a 404 USAGE.md link in the translated READMEs, the contribution OS-spec index row, the RFC roadmap pointer (M1→M9), and the templates/ .github summary.

📝 Changed

• ADR-0009 addendum (Decision: should generated repos profile CI actions be SHA-pinned? #132). Records that generated-repo profile CI actions stay version-tag-pinned (Dependabot-managed) by design — an apparent inconsistency surfaced on re-audit, not a design gap.

---

Full detail in CHANGELOG.md. The factory bundle, SHA256SUMS, and the setup.* installers attach automatically when this release is published.

---

This discussion was created from the release v2.4.0 — M10 post-audit hardening.