Sailfin 0.9.5

What's Changed

• chore(seed): pin cadence seed to 0.9.3 by @mcereal in #2855
• refactor(compiler): move import-context reads into driver by @mcereal in #2856
• refactor(syntax): graduate syntax and IR string helpers by @mcereal in #2858
• refactor(analyzer): graduate string helpers to sfn/strings (SFN-738) by @mcereal in #2859
• fix(build): follow re-export chains when writing runtime .import-deps (SFN-800) by @mcereal in #2860
• refactor(compiler): retire analyzer and LLVM prelude imports (SFN-739) by @mcereal in #2861
• refactor(runtime): swap tls_* onto the native TLS 1.3 stack; delete OpenSSL externs + -lssl/-lcrypto by @mcereal in #2857
• refactor(crypto): collapse 54 duplicated hex/eq test helpers into a shared support module (SFN-665) by @mcereal in #2862
• refactor(codegen-llvm): graduate core and lowering string helpers by @mcereal in #2863
• chore(codex): remove duplicate workspace skills by @mcereal in #2865
• docs(sfep-0048): un-defer AES-GCM — the deferral never ran the search by @mcereal in #2867
• fix(runtime): name the TLS failure instead of returning bare null (SFN-816) by @mcereal in #2866
• refactor(codegen-llvm): drain lowering events through driver by @mcereal in #2868
• docs(sfep): align analyzer prelude access wording with dependency matrix by @mcereal in #2870
• feat(crypto): AES-128/256-GCM AEAD — bitsliced, table-free, no seed cut (SFN-339) by @mcereal in #2869
• feat(runtime): negotiate and carry TLS 1.3 records under AES-128-GCM (SFN-814) by @mcereal in #2871
• feat(compiler): extract sfn/syntax capsule by @mcereal in #2872
• refactor(codegen-llvm): graduate expression string helpers by @mcereal in #2873
• fix(crypto): verify ECDSA P-384 / ecdsa-with-SHA384 certificate signatures (SFN-811) by @mcereal in #2874
• perf(ci): shard and cache aarch64 PR tests (SFN-826) by @mcereal in #2875
• fix(crypto): name the offending OID when x509_verify rejects an algorithm by @mcereal in #2876
• feat(crypto): verify RSASSA-PSS certificate signatures (SFN-824) by @mcereal in #2877
• refactor(ir): extract the sfn/ir capsule by @mcereal in #2878
• feat(crypto): Windows CA trust roots via the system ROOT store (SFN-808) by @mcereal in #2879
• fix(crypto): system CA trust store never loads — pem.sfn's 16-block chain cap fail-closes any real bundle (SFN-807) by @mcereal in #2864
• refactor(analyzer): extract the sfn/analyzer capsule by @mcereal in #2880
• fix(release): require arm64 payloads before publishing or pinning by @mcereal in #2882
• feat(lowering): emit a non-elidable secure-zero primitive by @mcereal in #2881
• feat(ci): promote aarch64 Linux to Tier 2 by @mcereal in #2883
• fix(install): bundle the runtime capsule dependency closure, and gate it by @mcereal in #2885

Full Changelog: v0.9.3...v0.9.5