v0.98.4

Added

• Dead-letter escalation can now forward across hubs, end to end. When a blackholed directed
  target's namespace is owned by a peer hub — resolved through the same namespace-ownership and
  relay routes the operator relay uses — an escalation forwards a pointer to that owning hub (the
  target and its undelivered count, never a message body, so re-delivery stays impossible by
  construction) over the federation transport and records a durable dead_letter_forwarding audit
  event. The owning hub, behind the same deny-by-default serving policy and namespace-ownership gate
  the operator relay uses, records a matching inbound audit (naming the verified sending peer) and
  broadcasts the pointer to its own operators, so the hub that can actually reach the missing reader
  learns of the gap. The two audits reconcile through a direction field (out on the origin, in
  on the owner). New core.dead_letter_forwarding holds the honesty-bound notice and its codec,
  core.dead_letter_forwarding_transport the fire-and-forget sender (the hub's default), and
  handlers.dead_letter_forwarding the peer-side receiver.
• synapse federation rotate keeps a domain's own trust bundle fresh: it pushes the expiry
  forward, unions new signing keys or certificate pins alongside the existing ones for a grace
  window (an old key stays valid until a later rotation retires it, so a peer that has not
  re-fetched keeps verifying), rewrites the bundle in place, and keeps the prior bundle as a
  backup. It mints no keys of its own — the added ids are generated through the tooling that
  already manages the domain's keys. New core.federation_rotation holds the rotation policy.
• The WASM sandbox can be confined to operator-approved workspace roots. synapse sandbox run --workspace-root DIR (repeatable) refuses, fail-closed, any preopen that resolves outside every
  approved root before the tool runs, and synapse sandbox validate --workspace-root DIR
  pre-flights the same verdict without running anything. With no root given the constraint is
  inert, so the policy is opt-in.
• synapse sandbox validate --check-paths pre-flights a manifest's filesystem grants against the
  live filesystem — the same host-path resolution the runner performs — and reports each grant as
  accepted (with its canonical directory) or refused (a symlink redirect or a missing directory)
  without running the tool, returning exit 1 when the manifest is valid but a grant would be
  refused here.
• Dead-letter blackholes can now escalate. A hub started with a
  dead_letter_escalation_threshold broadcasts a one-line dead_letter_escalation notice to every
  connected socket and journals an audit event when a target's undelivered directed-message count
  reaches the threshold, and again at each further multiple — turning the ledger's passive
  visibility into an active signal for a blackhole that keeps growing. It never re-delivers a
  message (the ledger holds counts and names, not bodies), so escalation points a human or an
  orchestrator at the problem rather than silently re-sending; the default of 0 disables it,
  leaving the ledger unchanged. New core.dead_letter_escalation holds the threshold policy.