fix: install umbra-core from source, not PyPI (yanked)

[bkd-dotcom]

umbra-core is source-available (All Rights Reserved) and every PyPI release is yanked, so pip install umbra-core>=X no longer resolves. This switches all functional install commands (READMEs, prerequisites, provisioning hooks/scripts, guard scripts, configs) to the git-source install:

pip install "umbra-core @ git+https://github.com/bkd-dotcom/umbra-core@v0.5.3"

Historical CHANGELOG entries are left unchanged. Not legal advice.

[github-actions]

Umbra Reviewer — 🟣 Escalate to a designated reviewer

Escalate to a designated reviewer — this PR touches security-sensitive surface (.github/workflows/reviewer.yml). No blocking issue was found automatically, but a human owner should sign off.

Deterministic gates (the authority)

Gate	Status
Required status check	— unknown
Secret scan	✅ clean
CI permission / OIDC	✅ no forbidden change
Dependency skew	✅ ok
All green	❌

Findings (1, 0 blocking)

• 🟡 Change touches a protected path: .github/workflows/reviewer.yml .github/workflows/reviewer.yml (via cross-check)
  • .github/workflows/reviewer.yml matches a protected pattern (.github/workflows/*). Changes here alter shared/foundational surface and warrant a designated reviewer.
  • Fix: Route to a code owner / architecture reviewer.

Sensitive surface

This PR changes security-sensitive paths that warrant a designated reviewer:

• .github/workflows/reviewer.yml

Merge

A designated reviewer / code owner should sign off before merge (sensitive surface).

This review is advisory. It never merges on its own judgement — the deterministic gates + a human are the authority. Findings can have false negatives; a green bot verdict is not a guarantee.