[0.8.0] Format 1.1, pieces and async reading

This release brings the Pithos file format to version 1.1 and reworks the library for embedding in storage services. It reads every 1.0 archive, writes new archives as 1.1, and appends to an archive with the rules of its own version. It can also read archives written by Pithos 0.7, but does not append to them.

Format 1.1

• The header version is 0x0101. A plain 1.1 archive differs from 1.0 only in this version byte.
• Recipient grant keys are derived with HKDF-SHA256 from the X25519 shared secret, the grant nonce and both public keys.
• A file's block list can be sealed in independent pieces, each with its own key. PieceEncoder encodes one part, and compose joins stored parts without opening any key. It also reports the BLAKE3 of the whole file when the part offsets line up.
• A metadata digest covers all directories and is checked on open when the caller passes it.
• Optional unique random block keys without deduplication, and optional AES-256-GCM block payloads next to ChaCha20-Poly1305.
• The specification is now spec/PITHOS_1.1.0_draft.md, with new conformance vectors. Appendix C describes reading Pithos 0.7 archives.

Library

• A reader without built-in I/O (ArchiveOpener, ArchiveView, lazy ReadPlan with batched reads), and an async API behind the async feature: AsyncArchive with read_range and the owned read_range_owned, limits on requests and buffered bytes, cancellation on drop, and a BlockingHook for CPU work.
• Fixed 4 MiB blocks by default; FastCDC content-defined chunking stays available for writers and for PieceEncoder. The specification presents both as equal methods.
• Default open limits admit objects up to 5 TiB.
• Raw X25519 key import and export, and ArchiveView::replace_grants to give an archive new reader grants without re-encoding its blocks.
• RO-Crate and Crypt4GH support are behind the default features ro-crate and crypt4gh. Crypt4GH export now also works for plain archives.

Security and robustness

• Keys and plaintext in Pithos's protected buffers are wiped on drop, on cancellation and on error paths, including the keys inside the AEAD ciphers. zstd's own allocations are documented as not wiped.
• Checked arithmetic for archive lengths, validated keys in piece records, and chunkers that stop reading at the end of input.

Breaking changes

• New writers use fixed 4 MiB blocks by default. Use Chunking::ContentDefined for FastCDC blocks.
• Archive::open no longer reads block markers; a missing or changed marker fails when the block is read.
• The minimum supported Rust version is 1.89. The library builds only on Linux.

CLI

• create and append files gain --block-size, --cipher and --unique-keys. read list shows the format version and each file's block-list form.
• The attached pithos binary is built for x86-64 Linux and needs glibc 2.34 or newer.

What's Changed

• Refine the Pithos specification draft and adapt reference implementation by @das-Abroxas in #36
• Release Pithos 0.8 with format 1.1 by @St4NNi in #37

Full Changelog: v0.7.0...v0.8.0