feat: OACP v0.4.4

[kiloloop-release]

Promotes OACP v0.4.4 — protocol docs, oacp CLI, kernel scripts, templates, tests, and CHANGELOG at the 0.4.4 release state. Tag v0.4.4 follows the merge and triggers the PyPI publish + GitHub Release workflow.

What's New

The central debrief store is the headline change: every agent's full end-of-session debrief now lands in the kernel-owned, append-only org-memory/debriefs/<project>/<YYYY>/<MM>/ layout — one immutable file per session — instead of per-project trees, with oacp org-memory init creating the store and oacp doctor checking its setup (org memory).

Added

• Central session-debrief store under org-memory debriefs/, created by oacp org-memory init and setup-checked by oacp doctor (org memory).
• oacp add-agent and oacp init --agents populate the instance agent registry; oacp agent sync backfills existing workspaces (agent profiles).
• oacp autonomy-finalize writes and validates checkpoint and terminal autonomy audit updates under lock; oacp doctor sweeps audit directories with the same checks (autonomy).
• Every persisted autonomy evaluation carries an evaluation_id; re-evaluations supersede the prior record through a locked transaction (autonomy).
• The wheel ships the four kernel protocol docs, the wire message template, and five previously unpackaged scripts under oacp/_protocol/, oacp/_templates/, and oacp/_scripts/.
• Preflight and CI fail when scripts/ and the wheel's force-include table drift apart.
• waiting_on_peer checkpoint sub-basis separates peer-reply latency from working time in a realized time breach (threshold checkpoint).
• Conformance fixture pinning the default scope envelope stamped on profileless admits.

Removed

• Zero-consumer scripts normalize_findings.py, create_handoff_packet.py, and init_project_workspace.sh with their Makefile targets; oacp init replaces make init.

Changed

• actual_minutes is active wall-clock from receiver-stamped work_started_at_utc, excluding admission idle and re-authorization pauses (threshold checkpoint).
• expected_files_touched counts distinct deliverable files only, not receiver bookkeeping, memory, cache, or scratch writes (autonomy policy).
• Parent-less oacp send messages get an automatic thread identifier (conversation threading).
• The README ## Commands table is generated from oacp --help via make docs, with a drift test.
• Moved the runtime capability matrix to the public Kiloloop research repository.
• Moved the prompt-caching guide to the public Kiloloop research repository, leaving a redirect at its former path.
• Raised the optional cryptography floor to 50.0.0 and the Python floor to 3.9.2 to exclude known-vulnerable crypto releases.
• Pinned the development and release toolchain through a shared dependency group and refreshed workflow actions to immutable commits.
• Folded SPEC.md into a thin index over docs/protocol/; the package Documentation URL is unchanged.
• Pricing/commercial content sensitivity is an advisory instead of a hard stop for reply-only task profiles (autonomy).
• Enveloped sessions can no longer write the receiver's audit/autonomy_decisions/ directly; only the canonical oacp audit writers can (autonomy).

Fixed

• Autonomy lexical classification records every match with its source span and demotion basis (autonomy).
• Negated or descriptive public-repository, dependency-install, and merge-method language no longer trips lexical hard stops; stacked negations and later unaccounted occurrences still cannot demote an affirmative match (autonomy).
• SPEC.md describes the archive-never-delete inbox lifecycle instead of saying recipients delete processed messages (inbox/outbox).
• The envelope hook no longer counts phantom files_touched from heredoc bodies or unexpanded shell variables; variable-spelled write targets escalate to ask (autonomy).
• Autonomy audit records carry a complete admission ledger (admission_axes), so a hard stop no longer masks the threshold, side-effect, or declaration axes (autonomy).
• declaration_error pauses record which profile field failed and why.
• A granted checkpoint re-authorization widens the live file budget, so extra files no longer stay blocked after a valid grant (autonomy).

Full Changelog: v0.4.3...v0.4.4