Rebased onto PR #12 head (47ca557). Vincent-only delta, no add/add conflict,
no tracked bytecode. All seven review items fixed:
3. schema_version bumped to 2 and ENFORCED (rejects v1, rejects missing)
2. audience_choice requires the chosen form to be the SOLE survivor and
every other form to be archive_ghost
5. receipts require non-empty action + exact power/scar/cost deltas;
provenance is structured {source_issue:int, pull:int|commit:hex}
6. true configured signer allowlist (frozenset); human:anyone rejected
7. non-empty audience source fields; malformed containers/items return
errors and never raise (fail-closed)
New negative tests for every reproduced bypass. Full clean-checkout suite:
51/51 pass; __pycache__ gitignored so a clean checkout stays clean.
Closes#19
Refs: #3, #13, PR #12, PR #18
