Changelog
- Flip WardenReport STATUS from "no consumer yet" to DONE; describe the
liveness challenge / replay / clock-spoof machinery now wired
- Add a WardenManager section: gating rule, file tree, what it owns,
logon->world lifecycle table, native-sourced identity, graduated
enforcement policy table, HWID-ban persistence, flat config keys
- Correct identity framing: msgConnect.HwId is warden-produced (not
forgeable plaintext); CPUHash prefers the native session value
- Rewrite the WIP migration note: warden_global_init is now called, prune
the dead [1500]MsgWardenNotify.cs:119 citation, flip WardenCipher span
API to DONE
- Mirror the landed state + commit range in in_progress.md section 2