v0.3.4

v0.3.4 — the Relic rite, the Oracle body guard, and the Tor package

The Shrine path is protocol-complete. Bulk content past the message
ceiling (an app blob, an asset pack) travels as a named **relic**: a
Reliquary transfer carried over the Pilgrimage on a stream of its own, its
manifest first, then each chunk as one request/response under the same
192 KiB frame ceiling the Auspice enforces - every chunk verified against
the manifest as it arrives and the whole file before the bytes are
returned, so a client proves a blob's integrity BEFORE executing it.
Hosts name relics through IRelicSource (StaticRelicSource proves manifest
fit at composition time); the Pilgrim end (ShrineSession.FetchRelicAsync)
lives in the node-free client stack, so it runs in a browser WASM build.
Frames carry the new `relic` CupriMark component.

The Oracle now guards its own bodies against the same ceiling, both ways:
an oversized handler response becomes a clear 500 naming the Relic rite
(the visit survives), and StaticFileOracleHandler refuses an over-ceiling
file before reading it - fail at the rite, with a reason, never at the
transport.

CupriNet.Tor is packed and pushed alongside CupriNet.WebRtc, so a
downstream can offer an onion transport as a package reference instead of
transcribing the binding. Closes #2.