AxiomGuard 0.5.1: release hardening and integration qualification

[imedkablavi]

Scope

Release-readiness/security hardening pass for AxiomGuard after the prepared 0.5.0 line.

Security fixes

• harden IPv6 SSRF classification for mapped/transition forms
• authenticate Stripe signatures before timestamp freshness disclosure
• add replay-protected GitHub delivery verification
• bound in-memory rate-limit/replay stores under high-cardinality input
• validate env defaults through normal schema constraints
• repair/reject invalid Redis TTL state

Release/QA

• advance package to 0.5.1 rather than mutating 0.5.0
• clean-room .tgz install/import/CLI/type declaration qualification
• real Express 5 / Fastify 5 / Hono 4 lifecycle integration tests
• real node-redis / ioredis tests against Redis in CI
• registry checks fail closed on ambiguous auth/network errors
• add threat model and CodeQL workflow

Compatibility

No intended breaking TypeScript API removals. New GitHub delivery replay helper is additive. The in-memory stores now have bounded capacity (default 10,000) and may evict oldest live entries under sustained high-cardinality pressure; distributed/high-volume deployments should use Redis.

Known boundary

safeFetch still cannot pin a prevalidated DNS answer to the socket used by the underlying Fetch transport. The threat model continues to require network egress controls for high-risk SSRF workloads.

CI must be green before merge.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.