v0.5.0 - security monitoring on every node (W1: wazuh agents on Debian and native on NixOS), supervision complete on the four-node mesh (S1), signed write relay fixes, Rust coverage baseline 81%.