bukio-cli v0.15.0 — Verifiable actor attribution

Verifiable actor attribution — resolves #1

The audit trail now records proofs, not claims. Every command is cryptographically signed by its declared actor (Ed25519) and verified against the per-company key registry before dispatch; audit verify re-checks the whole trail and detects tampering, replay, and revoked keys.

Added — actor identity (Tier 0)

• bukio actor CLI: keygen (Ed25519; human keys passphrase-encrypted), register, list, revoke, enforce --on|--off, unlock/lock (12 h sessions), verify
• Sign-and-verify gate: every CLI command is auto-signed (canonical digest + ±5 min window + 24 h nonce cache; replay refused in every mode)
• bukio audit verify: per-row ok | unsigned | revoked | tampered | invalid-signature | unknown-key, exit 1 on anomalies; a copied DB file verifies standalone
• MCP signed execution: every mutating tool call signed with the same gate, same guarantees across CLI + MCP
• Migration 018/019: per-company actor_keys registry + audit signature columns (legacy rows read back unsigned — backwards compatible)

Added — per-actor authorizations (Tier 0.5)

• bukio actor authz --on|--off: deny-by-default capability model (20 families, 6 roles) with segregation-of-duties warnings
• bukio actor roles / roles grant / roles revoke (owner-only; LAST owner never revoked)

Fixed

• Aging report: creditors leg now honours --as-of
• Invoice finalize: sequential number allocated inside the transaction with a UNIQUE-collision retry
• markPaid: payment insert + status transition commit atomically
• Recurring createTemplate: object postings kept in VAT-tagged lists
• MCP server: params: null answered cleanly (-32602, not -32603)
• audit verify: negative --limit rejected with INVALID_LIMIT

753/753 tests green. Full details in CHANGELOG.md.