v1.4.2 - MCP And Signature Hardening

Agent Circuit Breaker v1.4.2 fixes two security-relevant issues in the v1.4 MCP proxy and policy/rule-pack signature surface.

Highlights

MCP proxy now inspects all string-valued tools/call arguments recursively, regardless of JSON field name.
MCP proxy now inspects raw string arguments payloads.
--require-signature now requires authenticity, currently hmac-sha256.
Plain SHA-256 checksums are no longer accepted as required signatures.
README and security documentation now describe the distinction between checksums and authenticity signatures.

Scenario	Before	Now
MCP `arguments: {"input": "rm -rf /"}`	allowed, checks=0	blocked
MCP `arguments: {"code": "DROP TABLE users"}`	allowed, checks=0	blocked
MCP raw string `arguments: "DROP TABLE users"`	allowed, checks=0	blocked
Forged same-file SHA-256 with `--require-signature`	accepted	rejected
HMAC-signed policy/rule pack with correct key	accepted	accepted

Default check behavior is unchanged. The stricter behavior affects only MCP proxy inspection and --require-signature policy/rule loading.