v0.37.0: a journal witness, and a pin that travels

Two open findings closed, and one of them was recorded backwards in our own notes. The audit anchor gains a journal sink: the second write-only witness and the module's last named extension, appending each verified ledger head to systemd's journal over its native protocol, with no collector to stand up and nothing to configure but the sink name. Read the trail with journalctl -t proximo-anchor -o json. Its field-injection defence keeps hostile values intact using journald's length-prefixed binary form rather than sanitizing them to a token, verified against a real journal. Separately, a pinned TLS bundle is now a trust anchor on every interpreter: Python 3.13 changed the defaults create_default_context applies, so the same pinned file had been verifying on one Python and failing on the next, in opposite directions depending on what you pinned. Pin your node certificate rather than your cluster CA, which Proxmox issues without a keyUsage extension that a strict verifier is right to require. Full detail in CHANGELOG.md.