Raise the floor past CVE-2024-12797-affected wheels (43.x / 44.0.0).
Add constraints.txt (exact 44.0.1) and requirements.lock.txt with
sha256 hashes for cryptography and its runtime deps.
Add requirements.txt (cryptography>=43.0.0,<45) and docs/PROD_RUNBOOK.md
requiring SIGIL_SEAL_PASS and SIGIL_ANCHOR on separate storage. Document
info findings R9/R12/R13 in DESIGN; leave R10 domain separation as a
versioned follow-up (not backward-safe).
