Corrective documentation release.
- Replaces every supported source-install pin with an immutable protected-main snapshot that reports 0.4.2.
- Adds an installed-artifact contract that forces a shared-bucket collision and verifies scoped search, statistics, and deletion remain isolated.
- Declares the supported security floor as 0.4.2 and removes registry-status wording that could become stale inside packaged metadata.
0.4.1 is superseded; users should upgrade to 0.4.2 or newer. Runtime code is unchanged.
Published from tag v0.4.2 through GitHub OIDC Trusted Publishing with PyPI attestations.