fix: close v5.0.1 config and provenance audit tail

[ohjonathan]

Summary

Closes the v5.0.1 code tail for four audit findings and the folded-in maintain self-heal:

• D4a-config-1: neutral portfolio defaults; writable portfolio operations fail closed until configured; read-only access may use an existing database; verify --portfolio requires an explicit registry.
• D4a-config-3: consolidate now defaults to workflow.log_retention_count (20), with explicit --count precedence and preserved --count 0 validation.
• D4a-config-5: shared constants for the bundle token/log/window defaults without conflating unrelated numeric limits.
• R2-testpypi-provenance-1: immutable wheel/sdist manifest, exact version/filename/size/SHA-256 verification, TestPyPI-only hash-required wheel download, exact-wheel install and out-of-tree smoke test, and no --skip-existing.
• Operational tail outside the 33-finding arithmetic: decision-history writes self-heal missing or recognized generated ledgers while arbitrary malformed history still fails closed with zero moves.

This sets package metadata and release documentation to the v5.0.1 release candidate. Tags, publication, and all release actions remain maintainer-owned.

Important contracts

• Empty portfolio defaults never silently index ~/Dev, cwd, or XDG paths.
• Contributor consolidation uses the built-in workflow default without loading repository config.
• Production publication remains gated on verification of the exact TestPyPI artifact bundle.
• Missing/recognized generated decision history is repaired idempotently; ambiguous user-authored files are not rewritten.
• D5b-dead-code-3 remains deferred to v6.0.0 as the sole original audit finding after this PR merges.

Verification

• Full suite: 1,631 passed
• Focused config/consolidation/provenance suite: 135 passed
• Final release/version regressions: 13 passed
• Doctor phase-4 tripwire: 12 passed checks, green
• Real activation: 223 docs, 0 validation errors, 0 warnings
• Strict context-map generation and link check: green
• Wheel + sdist build, manifest verification, twine check, non-editable wheel install, and out-of-tree smoke test: green
• Cross-platform hash-required smoke-dependency resolution: green
• llm-dev manifest conformance: green
• git diff --check: clean

Review notes

The config/consolidation, documentation/ledger, and release-security surfaces received independent adversarial review. Review fixes include refusal of blank scan roots, byte-preserving CRLF history repair, least-privilege OIDC scope, and hash-locked smoke dependencies.

Please keep this draft until maintainer/Claude verification is complete.

[ohjonathan]

PR D review — Claude — approve to merge (no blockers, no majors) — closes the v5.0.1 code tail

Verified independently in a worktree at the PR head (4535de4), including a local exercise of the release path since that is what we are about to use.

The two phrasings that flagged scrutiny both check out

• config-1 "fail-closed access" is a justified consequence of scrubbing defaults to empty, not gratuitous creep. Personal paths (~/Dev/.dev-hub) are gone from all sites incl. the hidden cli.py:1946 fallback; the create-if-missing guard is preserved (no clobber). The new E_PORTFOLIO_NOT_CONFIGURED gives an unconfigured user a clear error instead of a silent empty portfolio — verified it fires for an unconfigured writable build and that existing configured users do not hit it; the read-only path cleanly reports a missing snapshot without creating one.
• R2 "no --skip-existing" — went further than the dispatch asked: a new stdlib-only scripts/release_artifacts.py + immutable manifest that binds tag→source→bytes, installs from TestPyPI with --no-deps --require-hashes (no PyPI fallback), and asserts version == tag. I built the bundle and ran create→verify locally — both passed, args matching publish.yml exactly.

The other three

• config-3 — user mode now honors .ontos.toml log_retention_count (consolidate.py:244), contributor mode uses default 20 without loading .ontos.toml, explicit --count wins, and --count 0 → exit 2 is preserved (guard moved after resolution). Verified behaviorally.
• config-5 — three constants; _DEFAULT_CONFIG_TEXT renders byte-identical (8000/20/30); the distinct 20s stay separate and the coincidental server.py/map.py literals are untouched.
• maintain self-heal — better than dispatched: it only heals a positively-identified ontos decision-history (heading + identity marker); malformed or unrecognized files fail closed with the file left byte-identical (test_consolidate_malformed_existing_ledger_fails_closed_without_moves, plus CRLF-preservation and missing-init tests).

Also confirmed

• Symptom B correctly deferred — scan-scope untouched, so PR C's count reconciliation and the activation tripwire are intact.
• Version bumped to 5.0.1 consistently in __init__.py + pyproject.toml (required for the tag to validate).
• CI 6/6; tripwire passed == 12 green; 118 focused tests pass.

One thing flagged (not a blocker)

The R2 publish.yml + release_artifacts.py are release-critical but only run on a v* tag, so PR CI never exercises them. The local create/verify run is the main pre-release assurance; verify-testpypi/verify-downloaded-wheel first execute against real TestPyPI at tag time. The gate is fail-safe (it blocks on mismatch rather than mis-publishing), so the risk is a blocked release, not a bad one — watch the v5.0.1 run and be ready to read logs.

Verdict: no blockers, no majors — ready to merge. This closes the v5.0.1 code tail; only v6.0.0's D5b-dead-code-3 removal remains. Release actions remain maintainer-deferred.