v1.0.4 — current-Ash compatibility + byte-bound corrections

Current-Ash compatibility release: the repo's own app surfaces carry Ash 3.33's required default_string_length_count, and the byte-bound correction family that requirement exposed is fixed.

Fixed

• Current-Ash compatibility — Ash 3.33 requires every application that compiles resources to set config :ash, :default_string_length_count (the app-level half of GHSA-cwjv-574p-59f6), which broke the CI floor and Livebook legs on lock-free resolution. The test application (repo-local, never shipped), the get-started Livebook, and the tutorial now carry the setting; the package writes no :ash configuration — consumers keep that choice, and both documented values work (see UPGRADING.md). A tripwire test locks the boundary.
• Byte-bound corrections (each red-proven):
  • Captured snippets and error summaries are capped in BYTES instead of grapheme-sliced — under :codepoints a grapheme-sliced 2048-char snippet of combining characters spans 4000+ codepoints and crashed the post-send ledger write (the same re-send poison class the control-byte strip closes).
  • Event.new/1 and the dispatcher guards bound ids/types by bytes — a 128-grapheme combining type previously passed validation and then failed every endpoint's dispatch create under :codepoints.
  • A thrown 255-char token no longer overflows last_error (262 bytes failed the enqueue-failure write itself).
  • An inbound handler failing with an invalid-UTF-8 binary now records [binary] instead of losing the failure record and leaving the delivery re-drivable.
• The tutorial's requirements line matches the tested floor (Elixir ~> 1.17, ADR-0010).

Changed

• mix.lock: ash 3.33.4; dev/test substrate cleared of published advisories (ash_sqlite 0.2.19 / ash_sql 0.7.5 — test-only; mix hex.audit clean).

Full notes: CHANGELOG · UPGRADING · hex.pm