v0.28.0

A LoRA or ControlNet made for another architecture is refused before loading (only trusted arches compared); --arch is validated; models list reports arch_trusted; hires default wording corrected; ADRs made consistent. See CHANGELOG.md.