Production-audit hardening (no API/ABI change): bounds-checked ELF NOTE parsing (OOB read fix), atomic_flag async-signal-safe re-entry guard, explicit CURLOPT_SSL_VERIFYPEER/VERIFYHOST, breadcrumb slot scrub on consent-revoke/GDPR, and tombstone_version() corrected to 0.9.1. See CHANGELOG.