Earworm v0.4.0 — akousma spec v1.3: under which ethics

Spec v1.3 (additive over all earlier versions): the optional covenant block — under which ethics this was listened.

• Records carry the listening covenant's identity (id, name, version, sha256 of its source text, extends lineage) and its honest absence: rules applied, what was withheld — counted and attributed to the rule that asked for it, never described — and the commitment count. The covenant's full text stays with its author; records stay export-safe by construction.
• New Rule 8 — sovereignty is recorded: withheld is not undetermined (which means the evidence could not support a claim; withheld means the covenant declined it); absence without attribution is indistinguishable from a bad ear. Consumers may filter, group, and audit by covenant.id; no consumer may reconstruct withheld content.
• py-akousma 0.4.0: covenant() builder, new_akousma(covenant=…), an indexed covenant_id column with in-place store migration, query(covenant_id=…), reindex() re-hoist. JS SDK mirrored. New v1.3 CI fixture.

35 Python tests + full pnpm check green.