v4.3.8 — the deliver-layer hotfix

Four live remediation-lane runs surfaced four defects; in every one the agent's work was verified sound, and the frame around it then lost, discarded, or misattributed that work. 4.3.8 fixes each at the root, with the class pinned by tests.

• A finding on a modified line no longer misattributes as net-new: the git-aware matcher pairs same-rule findings through replacement hunks, conservative 1:1 (ambiguity stays split, deletions never pair). Bulk formatter and codemod diffs stop false-blocking. (#271)
• A wall-clock kill is classified by the deadline, not the exit encoding — including the CLI's graceful exit-143 SIGTERM catch — and the runner sweeps stranded work before honoring any never-ran claim; a claim contradicted by the tree demotes to a disclosed failure. (#272)
• A landing push refused by repository rules or token permissions is a disclosed outcome carrying git's own stderr and the remedy; the attempt record (with the commit range) is written before the push, so a refused delivery never loses the evidence. (#273)
• The custom dispatch task honors the committed salvage policy; its verified, budget-bounded work lands as a draft PR under draft-pr salvage instead of being discarded. (#274)
• Every agent prompt now explicitly bans .github/ writes, with a write-the-proposal-in-notes escape hatch — the prompt-level mitigation validated in live runs.

Note: this hotfix was scoped as 4.3.7.1; semver has no four-part versions, so it ships as 4.3.8. The agent-capability release previously carrying that number renumbers (see #270).

Full changelog: https://github.com/vyuh-labs/dxkit/blob/main/CHANGELOG.md