v0.2.4

Fixed

• Read the Network Application version from the live-confirmed $.system.version response path.
• Classify version-schema mismatches with security-safe subreasons.
• Log only allowlisted field names and JSON types, never response values or session data.
• Added regression coverage for the confirmed schema and fail-closed config-flow behavior.

No controller-write behavior was changed.