* Add guarded native CA auditing and disposable request evidence
* Link AD CS changelog to PR 421
* Retain primary native CA failure before cleanup diagnostics
* Normalize native CA certificate hashes and record pending feature removal
* Emit bounded disposable CA request matching diagnostics
* Match observed version 1 CA request events with exact pending disposition
* Verify native probe presence in the local WEF collector
* Link WEF arrival changelog to PR 418
* Make duplicate JSON fixture independent of PowerShell formatting