pdfcer v0.31.0 — encrypt on save (AES-256 /R 6)

pdfcer v0.31.0 — Pass 5.4: encrypt on save (AES-256 /R 6)

pdfcer can now encrypt a document, set its permission bits, and remove
encryption — AES-256 /R 6 only (no RC4, no /R 2–5), in both the engine and
the pdfcer command line.

New — pdfcer CLI

• pdfcer encrypt <in> <out> --user-password … --owner-password … [--allow/--deny bits]
• pdfcer set-permissions <in> <out> --open-password <owner> … — re-key an
  encrypted document (owner-only)
• pdfcer remove-encryption <in> <out> --open-password <owner> — owner-only

Every one prints the permissions notice — "PDF permissions are a request, not a
lock. … Only the password protects the content."

Engine (pdfcer-core)

• EditSession::set_encryption / set_permissions / remove_encryption
• /R 6 (Algorithm 2.B) now reads and writes; the "unsourced" refusal is gone
• A wrong /R 6 password names the A13 loop-exit ambiguity rather than a bare
  "wrong password"
• A signed document is refused by name (encrypting would break its signature)

Cross-checked against pypdf 6.7.0 in both directions. All 29 local gates and CI
green; the engine still builds for wasm32.

Portable download

pdfcer-v0.31.0-windows-x64.zip — Windows 10/11 x86_64, single folder, no
installer. The GUI is the separate pdfcer-gui project. Verify with the
.sha256 sidecar.