oída 0.4.0 — the covenant engine: sonic sovereignty as runtime

Every listen surface can now run under a listening covenant — a plain-text declaration (English or Spanish) of what this ear will not listen to, will release after hearing, will not reveal, will not retain, will blur, or will refuse at certain hours, and why.

• Four gates: input (refuse sources, quiet hours, max window — a refusal answers 423 with the covenant and rule named), content (ignored classes: their perception passes are never even run), output (withhold transcript / speaker-identity / affect / location / song-identity / events / spectral-detail, or coarsen location to a declared radius), retention (raw audio released, memory writes refused — reported, never silent).
• The bridge, not the cage: rule lines the engine can't parse become commitments, carried verbatim and reported — sing to the river every equinox survives every hearing it accompanies.
• Honest absence on the record: events, traces, and shared-store akousmata carry the covenant block (identity, lineage, rules applied, attributed withholding, commitment count); the navigator filters by it.
• Surfaces: dashboard Covenant panel · GET/PUT /covenant + POST /covenant/activate · oida_covenant MCP tool (agents may propose; activation stays the operator's act) · per-listen covenant pin · remote-ear badges.
• Empty by default — sovereignty is opted into, never imposed.

Contracts: akouo/v0.7 pin, components earworm/v0.4 + akousmata/v0.4, gateway stays oida/gateway/v0.2. 163 tests. Also ships the new listening-point app icon.