UNASKED v0.2.2

UNASKED v0.2.2 is a fail-closed security patch for the public P0 research harness and its
unsealed M0 development path.

Security changes

provider timeout, output-overflow, and normal-exit cleanup now terminate ordinary
descendant processes through a Windows Job Object or POSIX process group;
concurrent ledger writers are serialized across threads and processes around the complete
verify-plus-fsync append transaction;
external replay receipts must structurally bind their replay subject, but remain
unauthenticated and cannot authorize VERIFIED without a future external signature trust
root.

This release remains explicitly NON_CERTIFYING:

m0_demonstrated=false;
no independently held sealed benchmark was used;
actor IDs and custody declarations are not cryptographically authenticated;
the local executor and provider lifecycle controls do not prove OS-level filesystem,
network, or hostile-provider isolation.

NO_VERIFIED_DISCOVERY remains a valid and expected result.