SunLit Security Libraries 0.4.0

Coordinated release of all twelve SunLit Security Libraries at 0.4.0.

• Publish the optional HMAC-only identity profile. Select secure_identity = { version = "=0.4.0", default-features = false, features = ["jwt-hmac"] } and initialize jwt_hmac::install_default_provider() at trusted startup before direct vendor JWT use.
• Preserve existing asymmetric/SSH defaults. Previous no-default-feature asymmetric callers explicitly enable asymmetric-jwt and/or ssh-public-keys; read the migration guide.
• The registry-only isolated normal/build graph has 195 packages and no rsa package, passed exception-free OSV and all six real JWT/startup/race scenarios. Additive/default feature graphs may retain rsa. This is no claim of RSA code elimination from ring, entropy, internal-copy erasure or cryptographic/scheduling proof.
• Preserve every external locked identity/source/checksum, audit and exact expiring advisory exception. Other eleven library APIs are unchanged. Mobile adapter and native reference/device-qualification limits from 0.3.0 remain.

Source PR #139 passed all 28 checks, including three OS lanes, workspace/profile regressions and actual Kani 0.68 red/green acceptance-kernel proofs. Local full-feature workspace tests passed 1,395 with 3 existing ignored tests. Both weakened assertions fail, both restored kernels pass, and all 13 explicit covers are satisfied; no cryptography/concurrency proof is claimed.

Each exact archive was source/checksum-graph reviewed and scanned before compilation/upload. All 12 downloaded registry archives/checksums/VCS match immutable package source 49612e1fe525ec87a9e0c60181d7d023a08aaa51. The actual approval record merged before tagging at 318512ab65a6894d81a8b73e3ac8df4eef0753ea.

Signing run: 38687007436. All 27 payload signatures, exact-tag workflow identity/issuer/commit/ref and manifest digests verify; bytes match the independent producer. All 12 dependency SBOMs pass the official CycloneDX 1.6 schema. Attached files comprise 12 registry archives, 12 SBOMs, capability declaration, approval record, SHA256SUMS and 27 Sigstore bundles.

Verify with cosign verify-blob --bundle <file>.sigstore.json --certificate-identity https://github.com/kerberosmansour/SunLitSecurityLibraries/.github/workflows/release-sign.yml@refs/tags/v0.4.0 --certificate-oidc-issuer https://token.actions.githubusercontent.com --certificate-github-workflow-sha 318512ab65a6894d81a8b73e3ac8df4eef0753ea --certificate-github-workflow-ref refs/tags/v0.4.0 <file>, then check SHA256SUMS.