v0.2.2

Security and robustness release. Nothing was removed and no exported signature changed.

Added: docs.MemoryStore.InitialMessageInNamespace and ProcessMessageInNamespace.

Deprecated: InitialMessage and ProcessMessage, which still compile and still reconcile across every namespace in the store.

Most of this release closes ways a remote peer could make an endpoint do or reveal more than it should.

• docs sync is confined to the negotiated namespace. A round used to reconcile every namespace in the store after authorizing one, and live sync broadcast inserts from namespaces neighbors never asked for. Sync frames are now capped at 16 MiB (was 1 GiB), buffers grow only as bytes arrive, and remote entries dated past MaxTimestampFutureShift are rejected.
• relayserver sends departure notices only to peers the departing session sent to. Any connected client could previously learn the identity of every endpoint that disconnected.
• Bounded reads and caches. pkarr relay responses are limited to MaxSignedPacketSize. Blob downloads check for trailing data by reading one byte instead of draining the stream. The socket's received-address cache is capped.
• Frame lengths that do not fit in an int are rejected in irpc and gossip. On 32-bit platforms such a length became negative and passed the size check.
• A stream listener survives a rejected peer. One handshake rejected by an AfterHandshake hook used to stop ListenStreams for every peer (#25). Thanks to @carsonfarmer for the report and the regression test in #26.

Three gossip fixes, each a case where a peer stayed subscribed to a topic but was never connected to it. A Join or ForwardJoin from a peer we had already answered once went unanswered, so its new subscription never saw NeighborUp. Closing a topic left its old neighbors in Neighbors and IsJoined after a resubscribe.

The docs changes are visible on the wire. A go-iroh peer never sends a frame larger than it accepts, and rejects entries dated too far in the future.