[WilliamClifton-dev]

Summary

Protect every /internal/* control-plane route with a deployment-supplied Bearer token, and make the project easier to evaluate from a clean Windows clone.

• Require an ASCII token of at least 32 characters; reject missing, invalid, malformed, and weak credentials before internal handlers run.
• Clarify Lite vs. Full verification baselines in both READMEs and move detailed historical records to a dedicated page.
• Expand the Windows quickstart with expected output, evidence locations, and common failure guidance.

Validation

• python -m pytest — 382 passed, 3 skipped (optional Docker tests)
• ruff check . — passed
• mypy src tests — passed
• Deterministic severity-normalization demo — passed; independent verification artifacts generated