v3.1.0

Released 2026-07-07.

A verifiability feature release. Task completion now produces a sealed,
content-addressed proof of what passed, not just a status line, and that proof
verifies with the same audit chain that seals everything else.

Verification evidence bundles (#2362)

"Done" used to be a status plus scattered logs that died with the worktree. Now
every completed task that declares evidence producers emits a verification
evidence bundle:

• Evidence producers (test command, coverage, lint, an optional screenshot or
  recording command for web-facing work) are declared in the task spec and run
  at gate time. Required producers gate completion; advisory producers attach a
  failure record without blocking.
• Bundle outputs are content-addressed, stored under a size-capped store with
  garbage collection, referenced from the task lineage record, and sealed by a
  new audit-chain event. Media evidence flows through the existing content
  credentials support.
• Sealing runs at task completion and is fail-open: a task that declares no
  producers is untouched, and any error while sealing is logged and swallowed so
  it can never block or fail a completion.
• bernstein evidence show <task> renders a bundle. bernstein audit verify
  now covers bundle integrity, so a tampered evidence file is detected exactly
  like a tampered chain entry, naming the file that broke.
• Deterministic producers replay to byte-identical bundle hashes, signatures,
  and journal anchors.
• Generated pull-request bodies link the sealed bundle: the bernstein pr path,
  the orchestrator auto-PR path, and the issue-to-PR path each emit an evidence
  summary when a bundle is present and are unchanged when it is absent.

Reliability

• Eliminated the order-dependent shard flakiness in the unit suite: the worker
  installs its terminating-signal handler before the PID file exists (so a
  signal in that window cannot leave a stale file for a later test), and
  retry-budget marker matching is anchored on token boundaries to remove a
  cross-test leak. (#2341)

Housekeeping

• Resolved the open refurb idiom warnings across the recently shipped
  interop, orchestration, and security modules; behavior unchanged.
• Removed the expired one-shot Scorecard 90-day self-resolve workflow now that
  the repository has passed the threshold and its tracking checkpoint is closed.
• Routine toolchain and action updates (uv, setup-uv, harden-runner, and
  frontend dependency digests).