[SizzleUnrlsd]

Summary

A schema 3 baseline holds no plain text, but its digests let anyone test candidate values offline. With a key, the baseline is recorded in schema 4: every digest (line text, value, JSON pointer) is an HMAC-SHA-256 under the key, and a key_check value tells the key apart without revealing it.

• Key sources: the file --baseline-key-file names (first), which must not be the analysed directory's or the baseline itself (compared as files: letter case, symlinks and firmlinks do not hide it), else CORETRACE_BASELINE_KEY. At least 16 bytes; trailing line breaks are dropped from both; an empty variable is an error. The key never appears in a report, message or file.
• A schema 4 baseline needs its key: missing or wrong key is an explicit error (exit 2) and nothing is recorded. While a key is given, an unkeyed baseline (schema 1, 2 or 3) is refused too, so it cannot stand in for the keyed one. Without a key, schemas 1–3 behave as before.
• No automatic conversion or rewrite. --record-baseline records explicitly (migration, key rotation); the file is replaced atomically (temporary file, fsync, os.replace, through a symlink, keeping its mode) only once the analysis succeeded and the report is rendered. Recording over a schema 4 baseline without its key is refused.
• Key and fingerprint handling live in findings/baseline.py; reporters never see the key.

Verification

New tests in tests/test_baseline_key.py (missing, wrong, prioritised and unusable keys, rotation, failed recording, unkeyed baselines refused with a key and migrated by an explicit record, old schemas without a key). No existing test changed. Independent review; its confirmed defects are fixed. Full suite green on 3.14 (apart from the local test_packaging environment issue) and 3.11; ruff, mypy clean; regression snapshots unchanged.

Closes #225