v0.4.28 — Preserve observations and bound inspection

v0.4.28 — Preserve observations and bound inspection work

This follow-up preserves independent repeated events for rate detection, fingerprints full detector inputs, removes repeated malformed-input suffix scans in Go and Rust, and bounds remaining source/SSH packet state. Full packet trackers continue admitting new identities and emit a coverage warning when older history is evicted.

It also removes nine unused Rust packages and all five prior advisory exceptions. No active cryptographic provider or encryption data is migrated; the empty pqc build feature remains for compatibility.

Upgrade the Go tool and optional Rust sidecar together. Existing ownership, authenticated-bus and restart requirements still apply. Portable sidecars do not include packet capture. Saturation can evict useful history; capacity warnings expose that reduced coverage. Trusted telemetry and configured response policies remain necessary.

Regression evidence, measured normalization results, dependency decisions and validation limits are in the follow-up implementation notes. This is a focused follow-up to the prior partial audit, not an exhaustive audit or a universal prevention guarantee.