W6 of SEAMLESS-UPDATES (releases#331): the update divulge, the trust-anchor status line, and adapter changelogs.

fixes #337
fixes #64
fixes #340

(Issues live on BigscreenVR/spt-bs-releases.)

## Commits
1. `reqs:` activate REQ-NOW-SIGNAL-UPDATE-DIVULGE [doc,impl,unit], REQ-UPDATE-STATUS-TRUST-ANCHOR [doc,impl,unit] (with doyle's ruling-C text correction: no expiry clause), REQ-ADAPTER-CHANGELOG [doc,impl,unit,int]. This is the first commit, so traceable-reqs gates the lane from the start.
2. `feat(adapter):` #340. Adds `[adapter].summary` and `[adapter].changelog`. The changelog is rendered once at registration, fails the install loudly when the file is missing or unreadable, and is served at `/<node>/a/<adapter>/changelog`. The schema and docs/MANIFEST.md change in the same commit as the parser.
3. `feat(update):` #337 and #64.
   - #337: an `UPDATED <subject> <old> → <new> at <HH:MMAM|PM YYYY-MM-DD> — changelog: <url>` row inside `<UPDATES>`. Old/new/when come from a new apply record (`releases/subject-applies.json`), written by the CLI and by the broker's trial promotion.
   - #64: a `trust anchor OVERRIDDEN (...)` line on `spt update status`.

## New dependency: pulldown-cmark (justification)
- **Why a renderer at all:** #340 requires each adapter's markdown changelog to be served as a rendered page. The tree has no markdown renderer: mdbook is release-side tooling, not a dependency.
- **Where it runs:** once, at install/update, inside `spt-runtime::registry::register_with_core`. The daemon stays a byte server and never renders per request.
- **Why pulldown-cmark:** it is the standard pure-Rust CommonMark parser (it is what mdbook itself uses). It is small and has no `unsafe` build steps or C deps.
- **How it is configured:** pulled with `default-features = false, features = ["html"]`, which drops the getopts CLI. That adds exactly three crates to Cargo.lock: `pulldown-cmark`, `pulldown-cmark-escape`, `unicase`.
- **Alternatives rejected:** a hand-rolled markdown subset, which would be a second bespoke parser to maintain; and serving raw markdown, which #340 rules out ("rendered at install").

## Gate checklist (from the brief)
- `traceable-reqs check`: exit 0, with the three REQs activated. Tags sit on the evidence (fn/test/doc paragraph), never at file tops.
- **Unmoved row byte-identical:** pinned as literals in `an_unmoved_subject_keeps_its_row_to_the_byte`, not re-derived from the formatter. It covers the no-record case plus three degrade arms: stale/rolled-back record, empty old, old==new.
- **Both apply-record writers, a unit each:**
  - CLI: `cli_core_apply_record_is_written_only_for_a_swap` and `cli_adapter_apply_record_links_only_a_declared_changelog`.
  - Daemon (broker promotion): `core_promotion_records_the_move_from_the_pending_record` and `core_promotion_writes_nothing_when_a_half_is_unknown`.
  - Both core writers go through the shared `spt_daemon::core_subject_apply`, and the CLI unit asserts equality with it.
  - Note: the daemon **pump** only stages (`pump/update.rs` never applies). The daemon-side applier is the broker's trial promotion (`ProductionTrialEnv::record_promoted`), so that is where the daemon writer lives.
- **No-declaration arm of the changelog suffix:** `a_subject_without_a_changelog_ends_after_the_time` (the row ends after the time, with no dangling separator) and the CLI adapter-writer unit (no declaration means no link).
- **Seen-set remains the only detector:** `the_apply_record_reshapes_a_told_row_but_never_tells_one` has the record on disk, yet the second poll is empty.
- **No notif row, no second render site:** `gather_updates` is the only composer, and no ADR-0046 producer was touched.
- **#64:**
  - Prints nothing new without the file.
  - `--json` gains `trust_anchor_override` only when the file is present.
  - Read-only: a unit asserts the file bytes are untouched.
  - Every key id and revoked id is listed in BTreeMap order.
  - No expiry is shown (ruling C).
- **#340 int:** `an_installed_adapter_changelog_is_rendered_and_served` installs through `register_with_core` and does a GET over the production listener. The declaring adapter returns 200 with rendered HTML. The non-declaring one returns a 404 naming the facet, and a decoy `web/changelog` file is never served.

## Negative controls (mutation, then restored)
- **#340:** disabling the load validator and the install render turned 4 tests red (the two shape units plus the render and refuse registry units).
- **#337/#64:** five mutations, each caught by a distinct test, 5/5:
  - dropping the `new == version` guard
  - composer ignoring the record
  - status printing a hint with no file
  - the CLI writer recording `AlreadyApplied`
  - adapter link without a declaration

## Legs run on hfenduleam (doyle GO)
- spt-runtime lib: 128/128
- spt-daemon lib (nextest): 1081/1081
- webserve_e2e: 6/6
- spt bin (nextest): 818/818, then +4 new
- source_verbs_e2e and false_promote: see the lane report
- `cargo clippy --workspace --all-targets`: clean
- `xtask check`: OK
- `traceable-reqs check`: exit 0

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_014j8UXzGXXsDsTJBYYUSCTC