pub const DEFAULT_FRESHNESS_WINDOW_SECS: u64 = 3600;
Production freshness window for signed-artifact verification. Matches CP’s channel-refs poll cadence (RFC-0010 §1.5).