Blockula v1.0.6

Blockula v1.0.6: the balance chart, the SDK's demo network, the wallet in Docker images, the invite QR. UNSIGNED, like every release so far.

This release is not signed. The offline ML-DSA-65 release key doesn't exist yet, so there's no
checksums.txt.sig and no release key id to pin. blockula release install refuses to install without one.

The one-line install.sh and the MCP's install_node check each archive's SHA-256 against checksums.txt,
whose first line is # blockula-release v1.0.6. With a logged-in gh, they also check its SLSA build
provenance (gh attestation verify <file> --repo jackdishman/blockula --source-ref refs/tags/v1.0.6), and
they report which checks ran. A compromised GitHub account or release workflow could produce both. The
stronger check is a bit-for-bit rebuild of the Linux archives:
COMMIT=66d7d1c78a50f3d20640a6fdb1e7a0bf889e35a2 scripts/reproduce-release.sh v1.0.6.

Blockula is for education and research only. Each chain's coins have no value: nobody sells them, buys them or gets paid in them.

What's new

• An account's balance over time on the wallet (#150).
• Explorer front-page news (#149): open proposals and large movements.
• The SDK knows the demo chain (#151): new Client({ network: "demo" }) and Client.demo(), pinned to its chain id, genesis hash and clock like the MCP's --network demo; the examples take --network demo.
• The playground's house bots (#151): deploy/host-bots.sh runs the trick-or-treat house and the guestbook on Fly next to a hosted chain. Docs on watching for payments sent to a name (match to.address, not action.to). The 1.0.4 install workaround is gone.
• The wallet in Docker images (#155, thanks @darkoheth): deploy/Dockerfile builds the served wallet in, so a Docker-built node serves /wallet/.
• A QR code for the wallet on the invite page (#154, thanks @darkoheth), drawn by the wallet's own encoder inside the explorer's one script.
• A shared-tab example (#143, thanks @janvierhumura): a tab split among friends and settled by .boo name.
• npm: @blockula/sdk and @blockula/mcp are 1.0.6.

No protocol change: v1 blocks replay exactly as before.