0.3.1

Fixes from a Codex code review of 0.3.0.

• CNAME MX hosts follow Postfix exactly: the first secure TLSA RRset (expanded name, then original) decides, a lookup failure stops. Before, an unusable or failing RRset at the CNAME target could fall back to the original name and answer dane-only where Postfix still defers. (#6)
• Request deadline enforced per recv(), a client dripping bytes can no longer stretch a request; replies are written with a timeout. (#7)
• Port ships its own danepolicy account (files/UIDs, files/GIDs via UID_FILES/GID_FILES) until the user is registered in the ports tree, so the README install path works; CI tests exactly that path. pkg-message uses %%PREFIX%%. (#8)
• TLSA full data (matching type 0) must be well-formed DER, cache lifetime includes CNAME TTLs, a socket in use is not replaced, cleanup only removes our own socket, stricter host name labels, explicit socket permission checks in CI. (#9)

Not adopted from the review: TEMP when only MX #11+ has TLSA - Postfix itself tries only smtp_mx_address_limit addresses, TEMP would block such domains permanently.