Statutor 0.7.4: hardened enforcement and provenance

This patch hardens the existing enforcement and provenance contracts after a full v0.7.3 audit.

• Staged checks retain policy authority from nested directories and detect Git mode changes to trust roots.
• Python and Rust agree on policy parsing, glob classes, task IDs, and diagnostics.
• Global instruction/skill operations refuse retargeted ownership and safely recover failed replacements.
• Worker recording and completion require the originating ledger/worktree and supported evidence capability.
• Antigravity batch edits are guarded, CRLF is preserved, and malformed Stop metadata remains fail-open.
• Release verification tests the exact candidate snapshot with original-repository trust receipts. Current native global probes and a tracked release runbook are included.

Distribution versions: Python/root and Antigravity plugins 0.7.4, OpenCode npm adapter 0.2.0, native crate 0.1.2.

After upgrading, begin a fresh worker session if an existing local session predates recorded ledger scope. Existing version-1 registries remain readable.

The independent runtime and Standards reviews passed. Validation includes the complete artifact gate, 109 Python/Rust conformance cases, seven Rust unit tests, actual Rust 1.75 execution, and 149,481 generated glob comparisons without a mismatch.