v0.31.2 — the adversarial audit of 0.31.1, every survivor fixed

A full adversarial audit of 0.31.1 — eight independent finder teams, every finding
adversarially verified before it was believed, and every survivor fixed. Thirty raw findings
reduced to twelve confirmed, a completeness pass surfaced three more (two medium, one
low-medium), and two independent review rounds on the fix diff itself caught defects in the
fixes before they shipped. Every fix carries a test proven red against the pre-fix source. No
new tools and no removed ones; the tool estate is unchanged at 906.

• Webhook secrets no longer land in the audit ledger (medium). The notifications plane
  widened its redaction key set to {token, password, secret, header} and redacts the
  current value on a delete plan — a webhook secret or custom auth header previously landed
  verbatim in the PROVE ledger and the returned plan.
• Guest-config changes that cross into the host now rate HIGH and say why (medium).
  plan_config_set escalates and names the crossing when a net value attaches a guest NIC to
  a host bridge or disables its firewall, or a usb/serial/parallel value passes a host
  device through — including the resource-mapping form usbN=mapping=<id>.
• Container-create privilege was keyed on a parameter that does not exist (low-medium).
  plan_create read a privileged key; the real PVE parameter is unprivileged, whose
  absence means privileged. The plan now reports the truth of the default.
• PROVE fidelity: an in-container exec timeout is recorded as error:timeout, not a bare
  error — the remote command may be orphaned and still running, and both the ledger and the
  caller's message now say so.
• Caller badges always expire: an absent exp gets a bounded 30-day default (previously
  never-expiring, indefinitely replayable).
• Consent approvers see the real command: plan_exec/plan_psql carry the un-redacted
  command in a preview-only field surfaced in the dry-run — never written to the ledger, not
  part of the consent id.
• --help no longer starts a live server on any of the four entrypoints.
• Smaller hardening: audit_verify withholds its anchor publish on a failed verify (and
  survives a first-run failure); HTTP errors scrubbed to action + status before the ledger;
  411 on chunked bodies with no usable Content-Length; control-character rejection in
  hardware-mapping free text; LDAP/LDAPS join the sensitive-port list; the PBS cert warning
  honors an active fingerprint pin; audit in_flight pairs entries per intent with a stack;
  opt-in PROXIMO_RECEIPT_DENYLIST for bare tokens the redaction regexes cannot see.

Full details in CHANGELOG.md.