v1.6.0 — English by default, three governance frameworks, production-ready failure behaviour

Everything since v1.2.3, driven by repeated adversarial audits. Every defect
fixed here was silent — nothing crashed, the dashboards rendered, the numbers
were wrong.

The product now speaks to its audience

• Dashboards, alerts and rules render in English by default. They were French:
  a platform team outside France deployed this and read Dépense par souveraineté
  on its screens. --locale fr keeps the French labels; adding a language is a
  JSON file, not a code change.
• Governance reads against the EU AI Act, ISO/IEC 42001 and NIST AI RMF
  (--framework). The same log volume evidences Art. 12, A.6.2.8 and MANAGE 4.1,
  so the measured panels are identical — only the reading changes. The board also
  states what it does not prove.
• Rules ship in two formats: the portable file (Prometheus, Thanos, Mimir,
  VictoriaMetrics, AMP, Grafana Cloud) and a PrometheusRule manifest for
  Kubernetes under the Prometheus Operator. --rules-window / --rules-interval
  adapt to your scrape interval.

Silent defects fixed

• output-token cost vanished from the recording rules (or dropping half the
  join) — undercounting by ~6x with no error shown
• recording rules produced nothing at all: prices and cost sat in concurrently
  evaluated groups
• PromQL escaping broken across the string layer: the AI Act sovereignty panel
  failed for every model name with a hyphen or a dot
• exporter namespace prefixes and UTF-8 metric names made every signal invisible
• datasource timeInterval unset, silently skewing every rate()

Production readiness

• a permissions 403 now yields an actionable message and a distinct exit code
  instead of a traceback; a refused dashboard no longer aborts the rest
• the client has no delete path — the blast-radius guarantee is structural,
  and reversal is one folder removal, documented
• supply chain: actions pinned to commit SHAs, read-only token by default, no
  expression interpolation in run blocks, zizmor in CI, the .skill built
  reproducibly by CI and never committed
• NVIDIA SkillSpector: zero findings on the shipped skill

Verification

161 offline checks across simulated topologies, every generated query executed
against a real Prometheus, value invariants proving the numbers agree with each
other, a full end-to-end deploy on the demo stack, and fault injection against a
simulated Grafana — all in CI.