v1.9.23

Security hardening release

Semaphore hardening (PR #89 + follow-up)

• Use O_EXCL with sem_open to prevent semaphore pre-planting attacks [pyllyukko]
• Recover stale semaphores after SIGKILL by unlinking and retrying
• Add sem_close before sem_unlink for proper cleanup ordering
• Fix compilation when NO_COMMAND_MODE is defined

Security audit fixes

• Fix out-of-bounds memory access in safein()/safeout() on socket errors
• Reject command socket connections from different user namespaces
• Use O_NOFOLLOW for PID file to prevent symlink attacks
• Open random device with O_CLOEXEC to prevent fd leak across execv
• Restrict semaphore permissions from 0644 to 0600