v0.98.24

Release integrity

• The 0.98.23 notes described the Cloud HSM / KMS KEK backend, threshold
  escrow, hardware attestation gate, synapse sqlcipher rekey/migrate, and
  the Studio operator-actions panel, but the 0.98.23 tag predates those
  commits — they ship in this release.

Added

• Pinned-TLS multi-hub pull: synapse multihub follow --pin sha256:<hex> and
  core.multihub_transport.pinned_connector accept a self-signed or private-CA
  wss:// peer by live certificate pin, mirroring the federation fetch --pin
  ceremony; a mismatch or plaintext URI fails the pull closed with the cursor
  unadvanced. Shared client-pin primitives live in core.tls
  (pin_trust_client_context, live_peer_certificate_pin).
• synapse hub --multihub-watch-pin PEER=sha256:<hex> (repeatable): the
  standing watch pulls a pinned self-signed wss:// peer through the same
  pinned connector; a pin naming an unwatched peer is refused at startup.
• --observed-pin HUB=sha256:<hex> (repeatable) on synapse who, state,
  status, and dashboard: advisory observed-peer pulls accept a self-signed
  wss:// peer by certificate pin; a pin naming an unfetched hub is refused.

Changed

• CI installs sqlcipher3-binary in the test matrix so the SQLCipher at-rest
  suite runs instead of skipping.
• Dashboard HTML rendering extracted from the server module into
  dashboard_render.py (one escape helper, per-section renderers, cockpit
  hand-off); dashboard.py keeps the snapshot model, HTTP handler, and server.

Fixed

• Remaining ad-hoc numeric coercions on untrusted fields moved to
  safe_int/safe_float with each site's fallback semantics preserved: A2A
  task-timeout sweep and store retention stamps (a hostile updatedAt mapping,
  a JSON integer too large for a double, or NaN no longer crashes the sweep or
  poisons retention ordering), replay claim reconstruction epoch/version,
  adaptive-TTL claim timestamps, lease-table rendering, and the relay resource
  capacity (now failing with the command's ValueError contract instead of a
  raw OverflowError/TypeError).