Security patch versioning

A hardening change that alters distributed runtime behavior is released as a patch version unless it intentionally changes a public API contract. The release must be built and tested from the final merged commit; unpublished branch artifacts are not treated as release evidence.