* Gate historical controls and require provenance for Windows defaults
* Bind default evidence to UTC provenance and native architecture
* Reference PR 409 in applicability changelogs
* Add selective native provider packs with pinned rule and schema evidence
* Reference PR 411 in provider-pack changelogs
* Fix provider pack service reader export and CI exit propagation