v0.2.0 — the air-gap release

The air-gap release.

Beam: file transfer with no network at all. The sender animates QR codes on
screen at about ten frames a second, the receiver points a camera at them, and
nothing crosses a wire. The payload is a fountain
code, so the receiver needs
enough frames rather than particular ones — at 30% frame loss that is 2.08×N
frames against the 10.7×N a numbered loop would cost. The first N frames are
sent plain, so a clean capture costs exactly N. The manifest is interleaved
every 20 frames, so a receiver can join mid-stream. About 6 kB/s, with a 1 MiB
cap applied after gzip.

Beam is not encrypted and cannot be: no handshake means no key agreement, no
forward secrecy, and no SAS. Both beam screens say so, and the README carves it
out of the threat model rather than letting the document's other claims appear
to cover it.

qrdrop web serves the browser UI from the installed package on
http://127.0.0.1:4173 — the way to use the browser flow while running code you
can read first. Loopback only: http://<lan-ip> is not a secure context, so
WebCrypto and the camera would fail there. site/dist/ now ships in the tarball,
built by prepublishOnly, so nothing is compiled at npx time.

Releases are published over OIDC trusted publishing, with provenance. There
is no longer an NPM_TOKEN anywhere.

The site gained a three-step orientation strip above the transfer UI, an
Open Graph card (site/og.png, generated by scripts/make-og.mjs), links out
to source, issues and author, and a content-hashed stylesheet — GitHub Pages
serves max-age=600 and ignores site/_headers, so a stale stylesheet was
being served against fresh markup.

Fixes. node-datachannel is pinned to 0.33.0, the last version with a
complete platform set. adopt is honoured when an element is created, not only
when it is patched. The pairing screen says each thing once, and buttons admit
they were clicked.

Credit. qrbeam is where the idea of
beaming a file over animated QR came from, and txqr
got to the fountain code first. Neither is a strawman and no code was taken from
either.