QorCap v0.3.33: audible challenge alert and scorebug re-anchor

receipt.v0.json is unchanged. Nothing new is written to the receipt or a checkpoint.

• When QorTime posts a liveness challenge, the console plays a loud three-beep clip, tries to show a Windows toast with the prompt (best-effort; some Windows builds refuse it), and flashes the console caption and taskbar button until the window is focused. These alerts are local to this PC and non-blocking: they run on a separate worker after the challenge is recorded and posted, they do not move the issued or deadline times, nothing about them is sent to QorTime or written to the bundle or receipt, and a missed challenge is still a miss. Set QORCAP_CHALLENGE_BEEP=0 to skip the clip (QORCAP_CHALLENGE_TOAST=0 and QORCAP_CHALLENGE_FLASH=0 skip the others); the old MessageBeep still runs. Windows only. Covered by unit tests; not yet exercised on Windows hardware. PR #83.
• The standard-bar scorebug reader re-anchors a stuck score or clock lock (4 gated reads across 2 s) and abstains on an illegal score step. On an unresolved disagreement it publishes null scores and winner unknown, unless a gated end-menu final is present. Re-anchor notes are written to reanchor_notes.jsonl in the match bundle, not to the receipt. No clock or banner template is cut from the held-out matches: the standard-bar clock uses the stock glyphs and no banner pack ships, so field-goal and touchdown banners are not detected. PR #76.
• contracts/compat.json and contracts/qorcap-bundle.v0.json re-vendored from QorTime main (dd01b6c, then 61976ca), and a CI job compares the vendored contracts against QorTime main. PRs #72, #74.
• Vendored contracts re-vendored from QorTime 585ccc4 (frame-bind and readers schemas). Submit uploads frames.jsonl and readers.json when present; this recorder does not write them yet. PR #87.
• CI runs the sidecar scorebug reader tests on Linux and Windows. PR #73.

qorcap.exe sha256 bd1b8b2f14ffa55fc870cc8b55d6880b93324ae63a4eb3d288a3af7248fd61d4