Release notes figure consistency (pre-tag)

CHANGELOG.md

@@ -19,7 +19,7 @@ Versioning: [Semantic Versioning 2.0](https://semver.org/spec/v2.0.0.html).
 
 ### Changed
 
-- **The language check now judges the sources on disk, not the build manifest.** The manifest chain reads build orchestration, so a C++ SDK driven by Gradle or a Rust core shipped through npm was mislabelled by construction — measured across realistic repo shapes, the old comparison blocked 12 of 19 normal projects under `--strict`, including labels cladding's own onboarding had just written. `TECH_STACK_MISMATCH` now reads the observed source distribution from one shared vocabulary: a language it does not know, or a tree with under five classified files, produces silence instead of a false alarm; a declared language absent from the sources still warns with the evidence in the message; a declared language present but under 10% is disclosed at info and never blocks. Gate-command selection still uses the manifest chain — "what do we run" and "what is this project" are different questions, and only the second one moved.
+- **The language check now judges the sources on disk, not the build manifest.** The manifest chain reads build orchestration, so a C++ SDK driven by Gradle or a Rust core shipped through npm was mislabelled by construction — measured on a 32-shape corpus, the old comparison blocked 12 of its 25 normal projects under `--strict`, including labels cladding's own onboarding had just written. `TECH_STACK_MISMATCH` now reads the observed source distribution from one shared vocabulary: a language it does not know, or a tree with under five classified files, produces silence instead of a false alarm; a declared language absent from the sources still warns with the evidence in the message; a declared language present but under 10% is disclosed at info and never blocks. Gate-command selection still uses the manifest chain — "what do we run" and "what is this project" are different questions, and only the second one moved.
 - **The module-honesty scan now derives its universe from evidence.** `UNMAPPED_ARTIFACT` picked one file extension from a six-language table; declaring cpp, java, or csharp fell through to `*.ts`, scanned nothing, and passed vacuously on exactly the projects the check exists for. The scan now unites the extensions observed in the tree with the extensions of modules the spec claims under its layer roots — so an unknown language enters the universe the moment a feature claims a file in it — and infers scan roots from the claimed paths themselves (the Kotlin `src/main/kotlin` layout now comes out of inference, not a table). A root must carry at least a quarter of the layer-claimed modules, which keeps directories that merely reuse a layer name from flooding the scan.
 - **Generated CI stays on the current release line.** New workflows run `cladding@<major.minor>` instead of an unbounded package selector. `clad doctor` names existing GitHub Actions workflows that use an unversioned or floating `npx cladding` command without modifying them.
 - **Plugin mirrors are built from source before distribution.** Standalone `npm run build:plugin` no longer treats a stale or missing root bundle as authoritative, and Claude hook metadata relies on the host's standard hook discovery without duplicate declarations.

spec/attestation.yaml

@@ -23,7 +23,7 @@ attested_modules:
   .claude/settings.json: 08a64351770badf4
   .github/workflows/ci.yml: 8ea99219cb80df60
   .gitignore: d311656aff3813ca
-  CHANGELOG.md: 5f869dbb27431e60
+  CHANGELOG.md: 62efa82238103bd2
   CLAUDE.md: 9f2fa4edd5c6df80
   GOVERNANCE.md: 21cc28eaaf637a20
   README.html: e648da173a27d318