moria 0.2.0

moria 0.2.0

New formats and detections:

• UPX-packed executable detection (ELF/PE/Mach-O) via the trailing PackHeader and its checksum, with a tampered-header heuristic for stripped/altered stubs (#9).
• VBF (Ford/Volvo ECU programming container) identify and extract, including qvbf-LZSS block decompression and per-block CRC16 verification (#3, #5).
• Embedded YAFFS2 is now detected mid-stream, not only at offset 0; images are sized by walking the chunk stream, with extra-header tag decoding and sparse / data-only handling (#4, #6).
• dm-verity hash-tree superblocks are identified and sized.
• RAE Systems / Honeywell RFP firmware packages identify and extract, LZARI-decompressing each section (community contribution, #1).

Correctness and robustness:

• ELF sizing validates the header tables before trusting a size, so a corrupt ELF can no longer fabricate a multi-gigabyte region that masks real data (#4).
• uImage no longer trusts ih_size when the header CRC fails (masking guard, #7).
• Added a per-finding and file-level diagnostics channel surfaced in both human and JSON output (#6).

Build and CI:

• GitHub Actions: build and test on gcc and clang, an ASan+UBSan job, and a libFuzzer smoke run on every PR and push (#8).
• Install ships only the binary and man page; the signature sets are embedded in the binary.

Thanks to @rabernethy for the RFP firmware support and format request.