v0.4.1 - Guarded verification hardening

Highlights

• Hardened Classic STORM completion with staging-first publication, strict citation and artifact evidence, SHA-256 rechecks, publication receipts, and rollback for recoverable publication failures.
• Added persistent Co-STORM turn validation with a versioned schema, stable participant and source mappings, idempotent hash-linked logs, and lifecycle gates for warm start and final reporting.
• Synchronized README, CONTRIBUTING, examples, CI, forward-eval fixtures, and installed bundle checks with the guarded runtime contract.
• Preserved the public skill interface: skills/storm, name storm, and $storm remain unchanged.

Release verification

• 66 unit tests passed.
• 120/120 isolated offline contract-canary runs passed across 12 cases with zero illegal transitions.
• Pinned and latest skills CLI discovery/render checks passed, including the public owner/repository install path.
• GitHub Validate and Pages deployment passed for commit 0504f88.

Capability boundaries

• Co-STORM remains a prompt-native preview and does not claim upstream CoStormRunner parity.
• Offline fixture canaries validate the contract, not real-model research quality.
• Classic validation does not mechanically verify the semantic quality of Co-STORM reports.
• B5 retrieval upgrades and B6 local-runner adapters remain intentionally out of scope.