slock v0.2.6

Dit has had a little tidy-up: friendlier instructions, a few nicer menu details,
and a substantial security review.

• The README gives the blinking-keyboard idea a gentler introduction, with setup
  details tucked away and the prototype's limits kept in plain sight.
• Microphone capture and playback stop correctly when re-pairing clears consent.
  Pausing stops voice, and queued packets cannot restart playback after disconnect.
• Identity storage rejects links and special files, uses private directory/file
  permissions, and keeps file descriptors out of helper processes.
• Pairing now displays a 128-bit verification fingerprint. Compare the whole
  fingerprint or full pairing code through a trusted channel. Existing pairing
  codes are unchanged.
• Unsolicited requests cannot read your nickname or displace a selected peer.
  Incoming processing is rate-limited, and MQTT connection IDs are randomized.
• Download Update… opens the GitHub release page. The previous custom
  self-installer was removed because ad-hoc signatures and release-hosted checksums
  do not establish publisher identity.
• Dit stays blue when a paired Mac is unavailable. Hold Option to see the
  installed version; pairing text fields support Command+V and Control+V.
• Added security regression coverage, a security policy, private vulnerability
  reporting, and read-only CI checks for pull requests and main.

Download slock.app.zip below. Quit the old app, replace it in Applications,
and reopen it on both Macs. Pairings and preferences remain, but macOS may require
renewed keyboard permissions. SHA256SUMS contains the ZIP's checksum.

This remains a prototype for macOS 13+, Apple Silicon and Intel. It is ad-hoc
signed and not notarized, uses an unauthenticated public test relay, and has no
forward secrecy. Please keep sensitive conversations elsewhere. See
SECURITY.md for the
security limits and reporting guidance.