Publish recovery 4 evidence - #46

What changed

• move the permanent Windows download redirect from recovery.3 to recovery.4
• document the sidecar exit barrier, setup-only stale-credential healing, active-identity protection, and install-path-aware firewall repair
• update the landing README's lifecycle proof claims without changing the existing product positioning
• bind the public evidence ledger and checksum file to all six recovery.4 packages

Public verification

• release: v0.3.1-recovery.4 (12 assets)
• distribution run: 30952445731
• merged source commit: 1e230bcd2a2480007f335333fda8c099f202a008
• all 12 local asset hashes matched the GitHub attestation statement
• attestation policy enforced the exact tag ref, source commit, distribution workflow, repository, and GitHub-hosted runner
• all three manifests, six package sizes/digests, and three checksum files cross-matched
• Windows installer SHA-256: f7863556c21828048f34725800db6cc3b9abac3aea449f35220f38086e6245c8

Validation

• scripts/Validate-Showcase.ps1
• git diff --check
• no recovery.3 URL or checksum remains on a current download/evidence surface