* Add protected canonical claims read API * Normalize claim loader exits in worker thread * Allow file-gated claims reader defaults