v0.4.3

Changelog

• e45afc1 Merge pull request #20 from 10xdev4u-alt/audit-fixes
• 3f33b27 docs(changelog): cut 0.4.3 — audit fixes (#20/#21) + deep-review hardening
• afdc4f2 fix: correct cluster-wide finding classification
• b7f70dd fix: escape Prometheus labels exactly once
• 74d9539 fix: harden the #20 audit fixes per deep review — dedupe, store eviction, MCP prompt, cosign anchors
• 59303c1 fix: parse archive_timeout as duration
• 7352c09 fix: pin installer cosign identity
• c56032b fix: reclaim space in size-cap eviction
• ada759a fix: redact DSN in diagnose prompt
• 6846e79 fix: skip preexisting findings in JUnit
• 5dababb fix: truncate finding text by rune
• 4302957 style: tagged switch for the duration-sign check (staticcheck QF1003)
• c53a8a8 test(junit): pin suppressed-wins-over-preexisting switch ordering