web4-governance: cleanup for review — declare deps, drop meta files

- Author email normalized to dp@metalinxx.io (single canonical contact)
- README: replace "no external dependencies / no network calls" with
  the accurate version (cryptography for Ed25519 signing; opt-in
  git fetch during git-push divergence checks)
- Add requirements.txt declaring cryptography>=41.0 (plugin still
  gracefully degrades if missing, but the dependency is now explicit)
- Remove meta-process markdown files that don't belong in the plugin:
  - web4-governance-issue.md (was the original issue body, in repo root)
  - plugins/web4-governance/PR_DESCRIPTION.md
  - plugins/web4-governance/FEATURE_REQUEST.md
  - plugins/web4-governance/HOOK_STDERR_NOTE.md
- Plugin documentation files retained: README, EVENT_STREAM_API,
  PRESETS, docs/RUST_CORE_PROPOSAL — those are real reference docs

Test status: 91 passed, 0 failed against fresh ledger.db (pre-existing
schema drift in long-lived local ~/.web4/ledger.db can cause 4 failures
on legacy installs; not affected by this cleanup).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: dp-web4

plugins/web4-governance/.claude-plugin/plugin.json

@@ -4,7 +4,7 @@
   "description": "Lightweight AI governance with R6 workflow formalism and audit trails. Every tool call becomes a structured request with verifiable provenance.",
   "author": {
     "name": "Web4 Contributors",
-    "email": "web4@metalinxx.io"
+    "email": "dp@metalinxx.io"
   },
   "repository": "https://github.com/dp-web4/web4",
   "keywords": ["governance", "audit", "trust", "r6", "provenance", "web4"],

plugins/web4-governance/FEATURE_REQUEST.md

@@ -14,7 +14,7 @@ This plugin adds structured governance to Claude Code sessions:
 - **Heartbeat Coherence** - Timing-based session health tracking
 - **Audit Trail** - Verifiable chain of actions with provenance
 
-No external dependencies. No network calls. Just structured, auditable AI actions.
+Minimal dependencies (`cryptography` for Ed25519 signing — see `requirements.txt`). No third-party governance services or SaaS dependencies. Local-only operation, except for an opt-in `git fetch` during git-push divergence checks.
 
 ## What's New in v1.1
 

plugins/web4-governance/HOOK_STDERR_NOTE.md

@@ -0,0 +1,8 @@
+# Web4 Governance Plugin runtime dependencies.
+# Plugin gracefully degrades (no signing, no audit chain) if these are missing,
+# but full functionality requires them.
+
+cryptography>=41.0  # Ed25519 signing of audit records
+
+# Optional development dependencies (uncomment to run the test suite):
+# pytest>=7.0