v0.5.0

Correctness of the SSA rebuild and the phi transforms. Every defect fixed here shares a shape: a value substitution or a definition record that was stated rather than established — a chain composed without resolving to a surviving target, a label asserting a definition that did not exist, or a rewrite recorded before its operands were known good.

On a 125 MB x86-64 reference binary (50,000 functions), pass rollbacks went from 6,094 to 0 and verifier-reported undefined uses from ~28,960 to 0; no function is now floored by normalization. Output is 6% leaner (10,089,320 to 9,490,820 lowered rows) while landing 4% more rewrites (94,257 to 98,467), because rejected work is no longer discarded wholesale.

Bumps serde to 1.0.229.

Ownership

• Recorded ATRAPS LLC as copyright holder and added a NOTICE file. The Apache-2.0 appendix was never filled in — it still carried the literal [yyyy] [name of copyright owner] placeholder.
• Added a repository field. The manifest declared documentation but no repository, so crates.io showed no source link for any published version.
• Dropped the deprecated authors field.
• Publishing now uses crates.io trusted publishing instead of a stored registry token, and refuses to publish a release whose commit is not contained in main.

First release under ATRAPS LLC ownership.