kit 4.0.0

BREAKING — strict by default: green means every check actually ran

• A check that could NOT run now FAILS the gate by default. Previously a
  scanner that was not installed, had no token, or errored surfaced as a WARN and
  the gate passed — so an unscanned tree looked green. kit check / kit ci now
  treat a did-not-run WARN as a failure by default: green means every check
  genuinely ran. Finding-WARNs (a check ran and flagged something) still stay
  WARN. Opt out per invocation with --lenient (or KIT_CI_LENIENT=1) to
  restore the old warn-and-pass behaviour; --fail-on-warning / --strict
  (or KIT_CI_STRICT=1) additionally fails on finding-WARNs.
  Migration: provision the toolchain (kit setup + [scan.tooling]
  vault-backed tokens, verify with kit doctor) so real scanners run, or pass
  --lenient where a scanner is legitimately unavailable. The single pure
  gateStatus() decides this for both check and ci.

Added — kit coverage --verify binds AUTO controls to live results

• AUTO no longer reads as "passing" without evidence. kit coverage --verify
  gathers checkSecurity() + runSelfAudit() and binds each AUTO control to the
  ACTUAL latest status of its backing checks: verified (ran + passed),
  failing (ran + FAILED — the control is not covered), or not-run (nothing
  bound a pass/fail). Binding is conservative — an unproven control reads
  not-run, never verified — and a failing backing check flips its controls to
  FAILING so coverage can never silently show green while a scanner is red. The
  static map (no --verify) is unchanged and still carries the honesty
  disclaimer. coverage.ts stays pure; the CLI does the IO.

Security — no false green in the self-audit itself

• New self-audit rule R13 (catch-false-green). Flags a catch block that
  returns a success shape (available/ok/verified/passed: true, or
  status: "pass") without surfacing the error — the exact "swallow the failure,
  report success" pattern the release hunts. Opt out on a reviewed line with
  // kit-self-audit: allow-catch-success. Zero findings on kit's own tree.
• Self-audit reports incomplete coverage instead of a false clean. When source
  files can't be read, the walk is partial — a "clean" result is not
  authoritative. The walker now surfaces the unreadable paths (console.warn)
  and self-audit emits a WARN ("scanned an incomplete set") that fails under
  --strict, rather than passing green on a half-scanned tree.

---

Full changelog: https://github.com/sandstream/kit/blob/v4.0.0/CHANGELOG.md

Verify this release:

git tag -v v4.0.0
npm audit signatures