Harden mutation guards and release publishing

[ppiankov]

Summary

• add change-aware Edit/Write guarding that preserves existing findings while blocking touched, added, changed, or missing secrets
• prevent proposed inline allow directives from self-authorizing secrets
• block default and configured unresolved placeholders, and fail closed on invalid active configuration
• ensure automated version tags start one serialized release path and document checksum verification
• pin mixed-null Anthropic tool-result redaction coverage
• package the hardening fixes as 0.33.2 and verify all release metadata stays version-consistent

Verification

• swift build -c release
• swift test (1,064 tests, 0 failures)
• swift test --filter ReleaseWorkflowTests (4 tests, 0 failures)
• swiftlint lint --strict (0 violations)
• bash -n docs/examples/claude-code/pastewatch-guard.sh
• workledger wolint . --diff origin/main..HEAD --project pastewatch --wo WO-528