v0.4.8

Deferred follow-up planning for Linux holder attribution and native-access/guard-liveness (#126, Draft #137), macOS visibility/support policy (#127), and Linux ARM64 fixture investigation (#161). Windows W1-W7 and the Rust prototype moved to the higher-priority Windows support (Rust) milestone #13. Preserve fail-closed behavior; Linux prototype remains Draft/NO-GO until its gates resolve. No release commitment or due date; do not prepare or publish v0.4.8 ahead of the prioritized Windows workstream.