v0.4.0 — verifies which window it is talking to

A security review of v0.3.1 found that nothing confirmed the connected window
was the one an entry was configured for. This release fixes that, and hardens
the workflows that publish.

Fixed: commands could reach the wrong window

Discovery matches on the BLE advertised name and resolves it to whichever
window is answering loudest. That is all an advertisement supports, but it is
not identity — two windows can carry the same name, and the loudest one is not
necessarily the one the entry was set up for.

Nothing checked. So a command sent to one window's entity could be delivered to
another, and that other window's view and power could be written into the first
one's entities.

The device UUID is now read and compared before the first write. On a
mismatch the connection is dropped and the entry reports as not ready, and the
state callback is attached only after the check passes, so a window that fails
it cannot publish anything on the way out.

What you may notice: if an entry now fails to load with a message about an
unexpected device UUID, it was previously talking to a window other than the
one it was configured for. Remove and re-add that entry.

Fixed: the test peripheral modelled an impossible window

The fake derived its device UUID from its BLE address. The address is precisely
what rotates, and the UUID is read over GATT precisely because it does not, so
the fake described a device that cannot exist — and a reconnection after an
address rotation would have looked like reaching a different window. Now keyed
on the window, with a test that a rotated address is still the same window.

Hardened

The release workflow interpolated a user-supplied ref directly into a shell and
checked it out unqualified. Git permits tag names containing shell
metacharacters, and an unqualified name resolves to a branch before a tag, so
a branch named after a release could have supplied the asset published under
that release — an asset HACS then distributes. The ref must now match vX.Y.Z,
is resolved to an immutable commit before checkout, and reaches the shell only
through the environment.

The wiki job holds contents: write and ran its publisher from a mutable
branch; it is now pinned to a commit. The validation workflow is explicitly
read-only.

Documentation

Two passages in docs/PROTOCOL.md followed the wording and structure of the
unlicensed third-party analysis too closely to be defensible as reporting
facts, and have been rewritten. The README's claim about that repository is now
precise about what was and was not taken.

Testing

78 tests: 26 protocol, 52 Home Assistant layer. The identity-enforcement and
rotation regressions were each confirmed to fail against v0.3.1.

Bluetooth is still faked throughout, so timing-sensitive behaviour remains
unproven against real hardware —
#5.