Guardrails & fail-closed

A fingerprint built from the commit at HEAD ignores edits in the working tree. We added a hash of the diff and the untracked source files, and a test that edits, adds and reverts.

A fingerprint that falls back to a plain string when git fails can match a stored release. We made an unknown fingerprint read stale and force a rebuild, and wrote tests for both outcomes.

An optional argument with a safe-looking default is a guard that a forgetful caller can skip. For anything that protects a boundary, make the argument required and let the compiler refuse the caller.

A build that warns about a leak will ship the leak. Make every check a refusal with a name, prove each one with a red case first, and let the build fail closed.