v0.2.5

Experimental 0.x release. Provider/device E2E acceptance remains; see README and docs/acceptance.md.

• Use the negotiated BUNDLE-tagged section for remote transport candidates,
  rather than combining unrelated media-section candidates. Add a local two-route
  regression: both routes answer ICE, but only the tagged route originates bundled
  DTLS. Preserve wrong-source rejection, bidirectional DCEP and authenticated
  media after a rejected packet. Cover tag/media ordering and a rejected suggested
  tag; execute the fixture under NativeAOT and against the pinned published baseline.

• Retain seven exact ICE data-admission rejection counters independently of packet
  capture, including no nomination, unavailable/mismatched path, wrong source,
  oversize, expired consent and shutdown. Export immutable, address-free snapshots
  through ICE and peer establishment evidence. Preserve existing admission checks
  and trace categories; add actual host/relay rejection, truncation and disposal
  regressions to managed and executed NativeAOT tests.

• Record a fresh real-provider timeout with incoming DTLS data rejected before
  parsing. The BUNDLE route regression is reproduced locally; its relationship to
  that provider's signaling remains unproven until deployed repeat acceptance.

Full Changelog: v0.2.4...v0.2.5