MCP v0.1.21 SONNY-4910: narrowly scope public OpenSSL signer scan exceptions. Exact scanner historical RED/GREEN and nine controls, expanded mandatory CI, filtered source-package build/unit/acceptance checks and normal hooks passed. Runtime and dependency pins unchanged. Hosted release gates remain required.