synth v0.68.0

What's Changed

• plan(v0.68): scope the release — "No success without the work" (9 artifacts, verified against source) by @avrabe in #1300
• RQ-68-STATUSGATE (#1250): a delivered artifact left proposed is no longer invisible — R11 + R4 widened, red on v0.67 RC, green on the tag by @avrabe in #1302
• RQ-68-NOPCLASS (#1272): the Thumb-2 encoder's seven silent NOPs now refuse, making #1289's WCET premise true, and 25 MVE ops stop claiming no VFP footprint (#1275) by @avrabe in #1304
• RQ-68-REPRO (#1291): same source, same file — a determinism gate over two independently built compilers, a SOURCE_DATE_EPOCH-pinned SBOM (#1292), and the SYNTH_* levers a build ran under (#1293) by @avrabe in #1305
• RQ-68-MPUHONEST (#1284): --safety-bounds mpu is refused where nothing programs the MPU, and accepted on --relocatable only with --embedder-mpu by @avrabe in #1310
• RQ-68-ONESOURCE (#1270): the register contract is declared once — byte-identical over the corpus, #1273 measured latent, the selector ratchet falls by @avrabe in #1311
• RQ-68-ORACLEABI (#1276): oracles and ledger evidence stop asserting what they do not check — R10 is a size, the base is pinned, Verus is a count, generators are gated, unlinked crates re-scoped by @avrabe in #1312
• RQ-68-CLAIMSDRIFT (#1285): documents stop claiming what the code does not do — f32 residuals, --link, acceptance rates, 0.85x, no_std, Spectre policy, a test-only peephole by @avrabe in #1313
• RQ-68-SUBTRACT (#242): select_default's production-dead size is measured and published — an upper bound, 88 Helium arms dead by construction, no deletion by @avrabe in #1314
• release(v0.68.0): "No success without the work" — 9 artifacts, 7 implemented, 1 measured without deletion, 1 deferred at cut by @avrabe in #1316

Full Changelog: v0.67.0...v0.68.0