v0.32.0 — security release, do not skip

This release fixes a security problem. The ### Security block in CHANGELOG.md says what it was, what somebody could have done with it, and whether you were exposed. Read that before deciding to install this later.

Three parts of one mechanism, and they install by hand. These three files are the whole release:
there is no package on any server and no plan for one. If you would rather install from Rhino's
Package Manager, tools/pack-yak.ps1 in the repository builds a .yak for a folder of your own,
which is also how to hand it round a studio — whoever can read the folder can install.

The .gha goes in %APPDATA%\Grasshopper\Libraries\. Then right-click it, Properties,
Unblock — Windows marks files that arrived from elsewhere and Grasshopper refuses a blocked
assembly silently. This is the step everybody misses.

The .rhp: drag it onto an open Rhino, or point PlugInManager at it. Rhino remembers what
it has loaded between sessions — but it writes that list when it closes normally, so a Rhino
killed rather than closed forgets it was ever told.

The .vsix: code --install-extension phenome-link-<version>.vsix, or let the canvas's
Pair with VS Code button do it on the first pairing.

Then restart Rhino. GET / on the port in %TEMP%\phenome-link-<pid>.port describes the canvas
protocol, and %TEMP%\phenome-rhino-<pid>.port the one that still answers when the canvas
cannot — whether Rhino is free, what dialog is holding it, and how to answer that.

What changed since the version you have is in CHANGELOG.md, which is written for that question
rather than for the commit history.

If that file has a ### Security block for a version above yours, read it before deciding to
skip this release. The link binds loopback and runs code in Rhino, so a hole in it is reachable
by anything that runs on your machine — a web page included. Those entries say what an attacker
could do and what to do about it, in plain words.