v0.5.4 — anchoring integrity hotfix

Same-day hotfix for three critical gaps an adversarial review found in the v0.5.3 anchoring path:

• Rebuilds no longer destroy existing anchors — tsa_token is preserved when the recomputed root is identical, dropped only when the underlying data actually changed.
• TSA rejections can no longer masquerade as anchors — PKIStatus is now verified; explicit rejections raise instead of being stored as proof.
• POST /audit/root/{date} is protect-by-default — already-anchored roots are never silently rebuilt (force=true to override), and the blocking TSA call no longer stalls the event loop.

Plus: UTC-correct daily anchoring, plan_triggered event dedup, and louder logging on metrics-persistence failures. 5 new regression tests; 1,446 passing.

If you installed 0.5.3 today: upgrade. Full details in CHANGELOG.md.