v0.16.0

Fixed

• web-check --online: a 404 without a token is now web_unverifiable, not web_not_found.
  GitHub returns 404 (not 403) for a private repo the caller can't see — indistinguishable from a
  moved/deleted file. Classifying every 404 as a break made a tokenless run (dev machine, CI, or a
  git hook without the PAT) false-fail on every private cross-repo link (the real "false breaks" that
  blocked pushes across sessions). Now gated on token presence:
  • with a token → web_not_found (trustworthy → fail-closed, exit 4);
  • without a token → web_unverifiable (ambiguous → does not fail, exit 0).
    This is the "fail-closed only when there is a token" contract. Pairs with the recipe reading
    $GITHUB_TOKEN from a RO PAT file (0.14.0) and the transient-retry fix (0.15.0).