v4.70.3

Patch, cut from 4.70.2. kj harden stops pinning unpublished versions, the Sentinel lets reads through, the seal commit passes the CI review check, kj run works with nvm, and pushing after merging main is no longer refused. Re-seal once after upgrading (kj harden --commit): the hooks change.

Fixed

• kj harden pins a kj version that npm has (KJC-BUG-0420, issue #2664): the policy and steward workflows install kj from npm in the consumer's CI, and kj harden pinned the version of the kj that ran it. From a checkout ahead of npm (a release being prepared, main between releases), CI died with "No matching version found" before judging anything. kj harden now asks the registry: it keeps its own version when published, otherwise pins the newest published one below it and says so; when the registry cannot be reached it keeps its own version and warns.
• The pre-push identity lock no longer judges commits the remote already has (KJC-BUG-0436): updating a pushed branch after merging main into it (to solve a conflict) brought main's merge commits, made by GitHub under another identity, into the range the lock checked, so the push was refused. It now checks only what the remote does not have yet, as it already did for a new branch. Takes effect after the hooks are re-sealed (kj harden --commit).
• The size checks count net lines, as CI does (KJC-BUG-0434): the CI gate and the policy's net_lines_added measure lines added minus removed, but kj review, kj pr-size, the third-party PR checks and the pipeline's commit step counted only the lines added, so a pure refactor was told it was over the 200-line limit. They all measure net now; kj pr-size --json adds a net field and keeps added. The Sentinel's branch-size note while editing measures net lines too (KJC-BUG-0435).
• The phone signature no longer reads as done after kj gave up (KJC-BUG-0432): kj waited 60 s while the relay accepts a signature for 3 min, so a signature after the first minute showed "Signed, go back to the computer" while the seal had already failed as expired. kj now waits 150 s, and the signing page refuses a request that has expired (5 s before, so kj's last poll still sees it) and says to run it again.
• kj harden hooks are byte-stable across machines (HU-2762, issue #2762): the generated hooks used to bake in the global hooks directory that git reported when kj harden ran, so under another HOME (a sandbox, a lane, CI) the chain disappeared and every lane started with 5 modified hooks. Each hook now looks up the global hooks directory when it runs, so the same bytes come out everywhere and personal guards keep working. One-time re-seal: after upgrading, run kj harden --commit once on main in every repo that commits its hooks (this one included) to regenerate the 5 hooks and re-seal the provenance in a single commit; until then kj harden shows the hooks as changed.
• The Sentinel's guards let a read name what they guard, and the governance guard sees relative paths (KJC-BUG-0429, ADR 0036): a Bash command that only reads (known readers such as cat, grep or ls, output to the session or /dev/null; never git, whose reads can run what its config names, KJC-BUG-0437) may now name the supervisor's files and the governance config; before, ls .karajan/harness/ or a grep on a workflow by absolute path was denied. The governance guard also missed relative paths in shell text, so a one-liner writing .karajan/policy.yml passed it; it now catches them. Whatever is not provably a read is judged as before.
• kj review --verify-pr accepts the seal commit (KJC-BUG-0388): the commit kj harden --commit makes is the human's act, signed from the phone, and no AI reviews it, so the CI check marked it as a commit without a verdict. A commit that brings the roster-signed provenance and leaves exactly the bytes that seal vouches for is now accepted and named as a seal commit; the proof is the signature, never the commit message. Anything else still needs its verdict, and a PR with no published review passes only if all its commits are seals (KJC-BUG-0438).
• kj run runs the project's suite and coverage command in kj's own environment (KJC-BUG-0427): both ran in a login shell (bash -lc), which re-reads your profile and may rewrite PATH. With nvm and npm_config_prefix set (as npx --prefix and npm scripts do), nvm took node out of PATH and npm test failed with "command not found", so a green HU was sent back to the coder; a login shell could also switch the node version. They run in a plain shell now.