ci: refresh stale workflow truth surfaces for the 0.4.2/mvar-1.6.0 era

- engine-parity embedded leg: set CLAWZERO_ALLOW_EMBEDDED=1 — the leg
  exists to test the embedded engine, so it uses the documented opt-in;
  the 0.4.1 fail-closed engine requirement (first CI exposure today)
  correctly refused without it. Verified locally: 60 failed -> 74
  passed/12 skipped across the parity trio.
- test.yml download-smoke + release-gate: clawzero==0.2.0 -> ==0.4.2;
  ledger-signer grep HMAC fallback -> Ed25519 (QSEAL) (mvar >=1.5.x
  signs the ledger); policy grep v1.4.3 -> v1.6.0. Every grep verified
  against a live-PyPI install of 0.4.2 before commit. NOTE: these pins
  assert the CURRENT release and must be bumped as part of each release
  (the 0.2.0-era strings going stale is exactly how this run went red).
- mvar-integrated.yml: mvar-security>=1.4.3 -> >=1.6.0.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: Sdvegas21

.github/workflows/engine-parity.yml

@@ -17,6 +17,10 @@ jobs:
         engine-mode: ["mvar", "embedded"]
     env:
       CLAWZERO_ENGINE_MODE: ${{ matrix.engine-mode }}
+      # The embedded leg exists to test the embedded engine's parity, so it uses
+      # the documented explicit opt-in; without it the 0.4.1 fail-closed engine
+      # requirement (correctly) refuses to run on the weaker engine.
+      CLAWZERO_ALLOW_EMBEDDED: ${{ matrix.engine-mode == 'embedded' && '1' || '' }}
 
     steps:
       - name: Checkout

.github/workflows/mvar-integrated.yml

@@ -19,7 +19,7 @@ jobs:
         run: |
           python -m pip install --upgrade pip
           pip install -e .[dev]
-          pip install "mvar-security>=1.4.3"
+          pip install "mvar-security>=1.6.0"
 
       - name: Run required Ed25519 witness test (no skip allowed)
         run: |

.github/workflows/test.yml

@@ -52,7 +52,7 @@ jobs:
           python3 -m venv /tmp/gate_test
           source /tmp/gate_test/bin/activate
           python -m pip install --upgrade pip
-          pip install clawzero==0.2.0
+          pip install clawzero==0.4.2
 
           clawzero doctor openclaw | tee /tmp/doctor.out
           grep -q "Status: SECURE" /tmp/doctor.out
@@ -80,13 +80,13 @@ jobs:
           python3 -m venv /tmp/download_smoke
           source /tmp/download_smoke/bin/activate
           python -m pip install --upgrade pip
-          pip install --no-cache-dir clawzero==0.2.0
+          pip install --no-cache-dir clawzero==0.4.2
 
           clawzero doctor openclaw | tee /tmp/doctor.out
           grep -q "Status: SECURE" /tmp/doctor.out
           grep -q "Witness signer:  Ed25519 (QSEAL) ✓" /tmp/doctor.out
-          grep -q "Ledger signer:   HMAC fallback" /tmp/doctor.out
+          grep -q "Ledger signer:   Ed25519 (QSEAL) ✓" /tmp/doctor.out
 
           clawzero demo openclaw --mode compare --scenario shell | tee /tmp/demo.out
           grep -q "MVAR-Protected      →  BLOCKED ✓" /tmp/demo.out
-          grep -q "Policy:  mvar-security.v1.4.3" /tmp/demo.out
+          grep -q "Policy:  mvar-security.v1.6.0" /tmp/demo.out