v0.4.3.1

What's Changed

• Silver criteria: repeatable build check, release verification, coding standard, assurance case by @Yoshiofthewire in #469
• feat(pgp): HPKE device envelopes v4/v5 (wire format, needs owner sign-off) by @Yoshiofthewire in #471
• security(workers): bump undici >=7.30.1 (DoS advisories) by @Yoshiofthewire in #473
• chore(deps): bump pinned Ollama to 0.40.9 by @github-actions[bot] in #472
• ci(codeql): run the security-and-quality suite by @Yoshiofthewire in #474
• fix(push): recover native push when one process's relay registration fails (#461) by @Yoshiofthewire in #475
• fix(apns-relay): evict rejected provider token; correct README env advice (#459) by @Yoshiofthewire in #476
• fix(web): reveal settings links when the phone Settings button opens them (#456) by @Yoshiofthewire in #477
• Add OpenSSF Best Practices and Scorecard badges by @Yoshiofthewire in #478
• feat: refine Busnes webmail layout and task controls by @Yoshiofthewire in #480
• appearance: shared radio cards and the 22-theme suite catalog by @Yoshiofthewire in #481
• Sync ky-ui 0.4.1 classic theme catalog by @Yoshiofthewire in #483
• chore: push relays move to *.relay.kypost.busnes.app by @Yoshiofthewire in #482

Full Changelog: v0.4.3...v0.4.3.1