v4.2.0: subtractive release — drop WATCH_CVE infrastructure Reverts the v4.1.2/v4.1.3 WATCH_CVE != 'true' guards. With cve-watch deprecated on the consumer side (replaced by daily basef-recurring + manual tools/acute-rebuild), the discriminator is dead weight. Validated at SHA 1ab93a60 via basef MR !19 (green) and carmine MR !19 (green).