SDK beta 4 makes local proof evidence fail closed

Both the npm beta and latest tags now resolve to version 2.0.0-beta.4. New integrations can use the normal package name while existing beta users can pin the exact version during evaluation.

The dedicated Proof V2 command resolves the current sibling engine artifacts, checks every required Auth V2 and Device V2 file, and exits with a failure before the test runner starts when evidence is missing. Its verified release run completed all eight real-proof checks without skips.

The Access Pass command now starts its own loopback-only PostgreSQL 17 fixture, applies the current engine migrations, runs real Groth16 issuance and verification, and removes the container, network, and volume afterward. It no longer depends on an operator remembering to start an undocumented database first.

The registry tarball was checked against npm's published SHA-1, installed in a clean temporary directory, and imported through its ESM entry point. The exact source tag and GitHub release remain available for inspection.

The canonical source repository is private, so this release was published without a Sigstore provenance attestation. Proof V2 and Access Pass remain experimental and are not production approved, independently audited, or substitutes for the passkey production path.