NFT Firewall V2 2.0.3

NFT Firewall V2 2.0.3 is the accepted provenance, boot-safety, package, and
dashboard status-contract release.

Validated source:
e2b3fa0a20fa6e36325792397564966b21045120

Before installation, read the default branch's docs/HOST-HANDOFF.md and run
the read-only scripts/host-preflight.sh. Installation is inert: it does not
create or start a VPN, activate NFTFW services, or apply a firewall policy.

Use the Debian package matching the target architecture and verify it with
NFTFW-2.0.3-SHA256SUMS. Candidate, CI, and development artifacts are
intentionally non-installable.

The release includes:

• amd64 and arm64 Debian packages;
• static nftfw, nftfwd, and nftfw-web binaries for amd64 and arm64; and
• a SHA-256 manifest covering every uploaded binary and package.

Checksums provide integrity. This release does not currently include a
cryptographic publisher signature.