v2.0.0

v2.0.0 — Holder-only shares (cryptographic 2-of-3), multi-unit storefronts, sats-only Market

⚠️ BREAKING — everyone you trade with must be on v2.x.x or higher.
This release changes the escrow LOCK format. Each 2-of-3 Shamir share is now
encrypted ONLY to its holder (sharePolicy "holder-only-v1"), so the federation's
bearer ecash can no longer be reconstructed by any single participant alone. An
older (pre-2.0) client cannot claim a lock created by 2.0 — it fails LOUDLY
("can't find your share"), no funds are lost, but the trade can't complete until
both sides update. Legacy pre-2.0 locks still claim fine on 2.0, so in-flight
trades drain safely; only NEW locks require the new build on both sides.

Security — holder-only shares + vote-carried release

• LOCK encrypts share i to holder i only (buyer / seller / arbiter); the old
  dual-encryption (every share to all three) is gone, so reading the relay no
  longer yields enough to reconstruct alone. The 2-of-3 is now CRYPTOGRAPHIC,
  not merely app-flow-enforced.
• A vote re-encrypts the voter's own share to the engine-computed payout
  recipient for that outcome (a pure function of state + candidate outcome,
  never a generic RELEASE/REFUND reinterpretation). The winner reconstructs from
  their own LOCK share + one agreeing voter's vote-carried share — two distinct
  shares, mixed senders.
• Verified on-device end-to-end: lock → votes → claim → reconstruct; cross-version
  loud-fail; legacy compatibility.
• Clearer claim failures: a pre-2.0 voter carries no release key, so the winner
  now sees "ask them to update and vote again" instead of a cryptic share error.

Multi-unit storefronts (#7)

• Create a listing with stock; buyers purchase N units as child escrows; Browse
  shows "N left" and hides sold-out listings.
• Seller overcommit refund: the last-unit race can oversell (Option A — optimistic,
  refund-the-extras). The seller — the only party who can decrypt every child's
  lock — now sees an OVERSOLD ORDER banner identifying which orders to refund, by
  lock order, so the storefront never delivers more than stock.
• Oversold safety: on an oversold order BOTH sides see a single refund-only button
  (Release is hidden) — the seller's reads "Refund duplicate order", the buyer's
  "Refund — get my sats back" — so no one can release a duplicate by mistake. The
  order also carries the buyer's short id (banner + Me card) so identical-title
  orders are told apart at a glance. The arbiter, if it ever reaches them, still
  sees both options.

Market = sats-only

• The marketplace category no longer offers external payment rails; Market trades
  settle in sats only.

Field-test fixes

• Vote tally colors and vote-button order now follow the Trinity ring's vertical
  layout; the arbiter trinity circle sits over "final decision".
• Chat image cap tightened so a 3-recipient holder-only envelope stays under the
  128 KB relay limit — images now reliably cross devices. The re-encoder also
  falls back through smaller edges so a phone screenshot (Android + iOS save PNG)
  always fits rather than hard-failing on a busy one.
• Friendlier Lightning copy on the money moments: locking, claiming, and refunding
  now name the sats movement in short, plain words.
• Market seller's refund button reads a neutral "Refund" (it's the first vote, not
  yet a dispute) instead of presuming "Buyer never received".

2077 tests green. Substitution of an absent assigned arbiter by a pool arbiter is
intentionally deferred to its own release: holder-only made the assigned arbiter
the sole holder of the arbiter share, so true substitution needs that share pooled
— a money-path change deserving its own verified pass. An unresolved dispute still
expiry-auto-refunds to the locker in the meantime.