New commands:
- proof liskov application hold release — return a held job to service without
  publishing a new policy version (ADR-0132)
- proof liskov application run — run a settled once Application once more
  (ADR-0125)
- proof liskov admin retirement adjudicate-lineage — dry-run/confirm lineage
  adjudication

Also: Checkout admission in organization billing reads; repository-less
retirement 403 and admitted reads explained.