v0.23.0

Two spine fixes from payment-blueprint's adoption: the locked region now covers a lane's own
tests and the declarations it reads. No migration — a Compose app has neither qa/test/ nor a
surface declaration by default, so its region, lock and receipts are unchanged.

Changed

• The lock region covers the lane's own tests. qa/test/** (every .mjs, recursively) is
  part of the machine-owned region when a project has it, so an adopter's suite that proves its
  gates is locked with the gates. Found by payment-blueprint, which could not vendor
  harness-lock.mjs without narrowing its integrity claim. A Compose app has no qa/test; its
  region and lock are unchanged. Pack tests now pin unique step names per profile (an aliasing
  factory passes a null check) and that the smoke profile stays pure-Node.
• The lock region covers the declarations the lane reads: qa/verified-surface.json and
  qa/harness-manifest.json. payment-blueprint's planted proof: one entry removed from the
  surface declaration un-attested 203 files while every checker stayed intact and the next
  receipt validated over the smaller surface. An edited definition of what the checker looks at
  is the same attack as an edited checker. State a lane writes (ledgers, journal, evidence) stays
  out. The framework check now plants a narrowed declaration and asserts harnessIntegrity
  names it (7 plants).