feat(core): detect repeated boot notifications - #114

…e state (#135)

PR #133, the first external contribution to a good-first-issue, failed CI and
needed four review items. Three of the four came from gaps in the contributor
guide rather than from anything the contributor did.

CONTRIBUTING.md now documents `pnpm format:check`, which CI enforces and the
guide never named, with both command lists ordered to match the CI job step for
step and a note that CI stops at the first failure. The hard-coded counts are out
of the architecture table: the detection entry claimed 15 rules and there have
been 16 since REPEATED_BOOT_NOTIFICATION landed in #114, and those counts have
now drifted twice. "Adding a Scenario" names all four files carrying the scenario
count and flags that only two of them fail the suite when missed. Station IDs are
documented as unique per scenario. Good-first-issues carry a claim policy of one
open claim at a time.

Also corrects the v0.4.x release state in CURRENT_STATE.md, which reported 0.4.1
with a 0.4.2 patch in progress. 0.4.2 is published and holds the latest dist-tag,
its tag and GitHub release exist, and both bugs it tracked (#127, #128) are
closed. The active milestone now reads v0.5.0 with v0.4.x complete, What's Done
gains the v0.4.x release record it never had, and What's Next drops the request
to cut v0.4.0, which shipped on 2026-07-17.

No changeset: neither file is in the package `files` list, so nothing here ships
to npm.

Closes #134
Closes #136

…us work (#146)

The living document drifted through two paths that bypass a normal feature PR:
the release PR is created by the changesets action and never touches this file,
and issue-only work leaves no PR at all. #137 through #140, #144 and the 0.4.3
release all landed without a record here.

Records 0.4.3 (2026-07-28) and 0.3.2 (2026-07-14), the latter never logged at
all, and corrects the package status table, which had read 0.3.1 since the
v0.4.0 release.

Adds a section covering the external contribution pipeline: the second
good-first-issue completing, the patch-not-minor changeset decision (#142, #143),
the detection-rule coverage audit that found 3 of 16 rules with no scenario, the
three issues opened to close it, the retarget of #108 after its expectedFailures
turned out to be unsatisfiable, and the station ID allocation across in-flight
issues. It closes with the arithmetic to the v1.0 target of 20+ scenarios.

Corrects an overclaim from #135, which described PR #133 as the first external
contribution to a good-first-issue. It is the second: #105 carried the label and
Develop-KIM completed it in #114, shipped in 0.3.1.

Replaces "None currently. All design decisions resolved in ADRs" under pending
decisions, since #144 carries four open questions.

Closes #145

Three of the 16 detection rules shipped with no scenario exercising them:
TIMEOUT_NO_HEARTBEAT, FIRMWARE_UPDATE_FAILURE and REPEATED_BOOT_NOTIFICATION.
REPEATED_BOOT_NOTIFICATION is the worked example: it landed in #114 and no
scenario followed, because the checklist never asked for one.

States the invariant at the top of "Contributing Detection Rules" and adds it as
step 7 of the checklist, paired with the step 6 false-positive audit. Step 6
confirms a rule stays quiet where it should; step 7 confirms it fires where it
should. The three uncovered rules are being filled by #137, #138 and #139.

Closes #140