UNASKED v0.4.0 - Authenticated evidence verification

UNASKED v0.4.0

UNASKED v0.4.0 adds an authenticated external trust plane while preserving the separation
between a software release and a research milestone claim.

Authenticated verification capability

• exact-byte SHA-256-pinned trust policies with Ed25519 role keys and threshold rules;
• DSSE PAE and in-toto Statement v1 verification for custody, isolation, ledger checkpoints,
  discovery authorization, trial evaluation, and M0 certification;
• a locked prepare/commit authority path that binds signed external inputs to a deterministic
  pre-state graph and an adjacent commit marker;
• full 35-run M0 verification against actual result bytes, ledger chains, final checkpoints,
  complete certificate sets, the evaluator statement, and the certifier statement;
• fail-closed CLI behavior for incomplete, unsafe, schema-invalid, substituted, or tampered
  bundles.

Hard claim boundary

This release is not an M0 result:

• repository and release metadata remain m0_demonstrated=false;
• no independently held sealed benchmark was run for this release;
• the bundled trust policy is explicitly SHADOW, includes public keys only, and carries no
  production authority;
• the package contains no private signing key, hidden case, ground truth, or sealed manifest;
• legacy and incomplete certification returns M0_NOT_DEMONSTRATED;
• a future M0_DEMONSTRATED result requires independently operated PRODUCTION keys, strict
  cross-role actor separation, sealed custody before Explorer development, authenticated
  external isolation and final checkpoints, a complete 5-by-7 run, zero false verified
  controls, and complete replay/context evidence.

Cryptographic validity authenticates configured keys and exact bytes; it does not by itself
prove real-world independence, secrecy, isolation, or absence of collusion. NO_VERIFIED_DISCOVERY
and M0_NOT_DEMONSTRATED remain valid and expected outcomes.