feat: OACP v0.4.2

[kiloloop-release]

OACP v0.4.2.

Headline (from the CHANGELOG 0.4.2 section):

• Enforce at intake is mechanism: signing.verify_mode: enforce now has a real caller — under enforce only signed-verified messages proceed; everything else quarantines to dead_letter/ with an intake_rejected decision, pinned by a new executable intake conformance corpus.
• Policy-file signing: oacp trust sign-policy signs receiver config.yaml + trust/allowed_signers.yaml under a distinct JOSE profile with context binding {project, receiver, kind} and machine-local enrollment (signature stripping fails closed once enrolled).
• Default scope envelope for profileless admits: 25 min / 2 files / reply-only bound with scope_envelope_source provenance; spec 0.4.2.
• None-by-rule public path: admitted public-visibility tasks with a recorded human approval get a recorded envelope_enforcement: none stamp instead of a silent absence.
• Plus hardening: single-read snapshot discipline on receiver read paths, one shared receive boundary for all non-gate inbox reads, and night-batch fixes (hidden agent dirs, negation demotion, version-only manifest edits, runtime.model resolution).

51 files changed, +5322/−216. Full details in CHANGELOG.md.

🤖 Generated with Claude Code