v0.2.8 - Lithos security fixes (wallet-API exposure, issue #4)

Found and reported by @odiseusme in #4 — thank you. The Lithos node-API exposure was a genuine remote-wallet-control hole.

A security and correctness release for the Lithos support. Ergo pool and solo mining are unchanged. Pearl (pearl-pow) is not in this build.

Security: the Lithos quickstart no longer exposes your wallet

lithos-quickstart.sh bound the Ergo node's wallet-capable API to 0.0.0.0 with an API key hardcoded in this public repo. Any peer that could reach the port could spend from the wallet, and it survived reboots. It now binds loopback only and generates a per-install key, stored root-only. If you ran the old quickstart on a reachable host, treat that wallet as exposed.

Also hardened:

• Ergo jar and Lithos client are fetched from pinned URLs and SHA-256 verified (first run and rerun); the Adoptium signing-key fingerprint is pinned; a mainnet install refuses an unpinned artifact.
• Node and client run as an unprivileged per-network service account, not root, with NoNewPrivileges/ProtectSystem=strict.
• The wallet password no longer lands in a world-readable file.
• Testnet and mainnet fully isolate: dirs, unit names, service users, and ports.

Correctness

• lithos-status now reaches the client (it was querying the node's port, so it always read "client DOWN").
• A zero-target job (a Lithos client with no share target yet) no longer serves stale work or a misleading timeout; it reports what is actually happening, on both startup and mid-session.
• The extranonce handler no longer has undefined behaviour on a malformed assignment, and stops work rather than mining a guessed nonce subspace.

Full detail in issue #4. No dev fee.

Windows: Defender will flag this as a coin-miner

Windows Defender flags every GPU miner, including this one, as a trojan (Trojan:Win32/CoinMiner, threat 2147731250) and refuses to launch it. That is the heuristic doing its job on a real miner, not a compromise of this build - the source is right here and the binary is built in CI. To run it, add a Defender folder exclusion for the miner's folder (Windows Security -> Virus & threat protection -> Manage settings -> Exclusions), or verify the SHA-256 above and run it from a folder you have excluded.