v0.9.4

Security fix — unauthenticated, pre-TLS remote DoS

A single malformed 2-byte fast-path frame (04 00 / 00 00 — first byte & 0b11 == 0, length 0) could spin the RDP framing reader (ironrdp-async's Framed::read_by_hint) at 100% CPU and wedge the whole server — the acceptor's connection loop stops accepting = full outage. It is reachable before TLS / CredSSP, so the connection-rate/lockout auth-guard never sees it, and the health-check watchdog misses it (single-worker spin — the trivial runtime probe still passes on the other workers).

Fix: macrdp now vendors ironrdp-async and guards read_by_hint to reject a zero-length unmatched PDU (Some((matched: false, length: 0)) → an InvalidData error → a clean per-connection rejection) instead of looping forever. This is macrdp's own upstream fix, Devolutions/IronRDP#1556, complementing upstream #1515's find_size hardening.

Verified: the exact 2-byte trigger fired ×10 leaves CPU at 0.0% (no spin, no pegged thread), the accept loop live, and each connection cleanly rejected. Found by the in-tree soak_abuse3 decoder-fuzz harness.

⚠️ All users on v0.9.3 or earlier should update to v0.9.4.

No other runtime change — the fix is a vendored guard in the framing crate, not a src/ change. See docs/release-history.md for full detail.