QorCap v0.3.29: device key, red team, and pad identity

This build collects the changes merged after v0.3.28. receipt.v0.json is unchanged, Glimpse stays observer-only, QORCAP_GLIMPSE_TD_VETO stays off, and nothing is written to the controller.

• PR #53: close path, receipt, key, zip, and spend-cap holes before live Stripe. Manifest and clip paths outside the bundle are refused, the signer keeps only properties the receipt schema allows, keys are created owner-only, and an unusable OpenRouter cost is booked at the worst-case estimate.
• PR #54: grip jolts and hard hand motion are low-confidence in haptic detection. They are capped, not dropped.
• PR #55: qorcap redteam scores synthetic replay, relay, splice, and receipt attacks with the checks that already ship. See docs/REDTEAM.md.
• PR #56: README corrections. A DualSense was read, and the QorTime referee is live.
• PR #57: qorcap device-key init|status. An opt-in TPM-backed device key (software fallback) and the device_attest.v0.json sidecar. receipt.json gains no fields.
• PR #58: qorcap submit refuses side-corrected or offline-re-signed receipts before any network call (exit 4, state: not_submitted).
• PR #59: a signed score_timeline.json sidecar for two-sided corroboration.
• PR #60: the controller identity is sealed into inputs.jsonl, and input-proof fails corroboration when the pad changes mid-match.

qorcap.exe sha256 525c7a4e99b79a22433781377835864c9fb00392edc8d06c14bded5bd4468997