Harden v0.4.2 spend rails and release validation

[clutchpbcfo]

What changed

• migrate unsafe unversioned legacy request caps to the six-request safe ceiling without rotating secrets
• preserve explicitly versioned operator overrides and surface above-default limits in hacb doctor
• add hacb budget --safe and explicit hacb budget --set <count> controls
• enforce the daily ceiling atomically across multiple bridge processes
• add migration, override, and cross-process regression coverage
• add a committed lockfile and SHA-pinned cross-platform GitHub Actions validation
• publish v0.4.2 release notes

Root cause

v0.4.1 changed the source default to six requests, but an upgraded machine could retain a larger value in its persisted configuration. The usage counter also lacked a cross-process lock. That made the public cost-control claim weaker than the actual upgrade path.

Validation

• Node.js v22.22.3
• Codex CLI 0.144.6
• 25 tests discovered: 23 passed, 2 intentionally skipped live Codex fixtures, 0 failed
• npm audit --omit=dev: 0 vulnerabilities
• npm pack --dry-run: passed
• cross-process test: exactly 3 of 8 attempts admitted under a cap of 3

Safety

No OAuth token, local bearer token, prompt, answer, or private machine state is committed. The bridge remains loopback-only and uses Hyperagent's documented OAuth MCP endpoint.