audit_chain 1.4.0

Audit Chain 1.4.0 — 2026-08-14

Added
- Scheduled keyed verification (d.o #3616535, part 1). Cron runs a full chain verification on a configurable interval (verify_interval, disabled by default). Each run records its verdict on the status report: a failed run is an error, a schedule that has gone quiet or never run is a warning, and a pass reports its last-run time.
- Alert contract. A failure logs an error to the audit_chain channel (SIEM-forwardable) and dispatches AuditChainVerificationFailedEvent so consumers bind their own alerting. Verification is strictly read-only — the chain is never modified by the check.
- Enterprise assurance profile (verify_require_keyed). Refuses unkeyed operation with a stable reason: no signing key, an unresolvable Key entity, or rows written unkeyed all fail instead of passing on plain SHA-256. Rotated keys keep verifying through previous_hash_keys.

Changed
- CI: the attribution check is the shared Wilkes & Liberty workflow; vendored script copies removed.

The versioned off-system stream/export contract is part 2 of #3616535 and follows in a later release.