v0.48.0

Changed

• synapse --version no longer performs the PyPI newer-release check by default.
  Set SYNAPSE_UPDATE_CHECK=1 to opt in; SYNAPSE_NO_UPDATE_CHECK=1 still
  suppresses the check.
• synapse hub now exposes --shutdown-close-timeout so SIGTERM/SIGINT
  shutdown has an explicit bound for active WebSocket close handshakes.
• Hub takeover and identity-conflict paths now emit payload-free audit logs for
  accepted takeovers, cooldown refusals, name conflicts, and name-switch denials.
• Added tools/fuzz_protocol_decode.py, an Atheris-compatible local fuzz target
  and deterministic smoke corpus for the bounded wire JSON decoder.
• Refreshed public first-trial docs to foreground doctor, git-init, and the
  localhost A2A bridge path without implying external conformance.