[Nico77600]

Changes

• SMTP authenticated-user attribution backed only by successful server evidence, proxy SID history, additive schema 6, bounded replay and transcript redaction.
• Bounded-memory Detailed reporting, split report C# sources, disk-backed datasets, bounded ordered CPU workers and complete CSV exports.
• Normalized extended Windows SQLite paths, time-zone fallback and IIS application log-folder discovery robustness.
• Verifier moved to src; fail-closed native owner/timestamp trust before execution; no compiled bin cache loading; separate last-signed manifest covering all 12 C# and 6 DLL.
• Byte-preserving Git attributes, native integrity tests and configured CI selectors; packaging copies only authenticated files and never regenerates protected guides.
• README/help/privacy notices, HTML and Markdown guides, changelog, editable report defaults, fixture tests and existing developer tools.

Local validation

• Existing configured native Pester suite: 185 passed, no failures, skips or not-run cases; all three RealSignature checks passed without a trust mock.
• Existing PowerShell analyzer: seven runtime inputs, no syntax/analyzer errors; existing production build: all 12 C# sources compiled.
• Existing native package builder: 31 files, all 29 protected hashes; byte-exact relocated copy and six owner/timestamp signatures valid under PowerShell 7 and Windows PowerShell 5.1.
• Required GitHub Validate (PowerShell 7) must succeed on the exact PR head before merging; local validation does not substitute for this check.

Scope

Version 2.1.0. Editable configuration and runtime installation paths preserved. C# and DLL protection is through raw SHA256 in the separately signed manifest, not individual Authenticode. No tag or release is part of this PR.