v1.29.0

[1.29.0] - 2026-07-13

• OTS upgrade hardening (review findings): upgrade_ots_anchor no longer follows pending-attestation URIs straight out of the proof bytes — a crafted proof could point the upgrade fetch at internal endpoints (SSRF). Only https URIs whose origin matches the anchor's recorded calendars or the package defaults are fetched; anything else stays pending, untouched. vaara receipt upgrade-ots now persists upgrades already fetched for earlier anchors before reporting a later anchor's failure.
• OpenTimestamps witness anchors for receipts (vaara.audit.ots_anchor, method opentimestamps in SPEC.md Section 4): submit the receipt's signed-payload sha256 digest to public OTS calendar servers for a Bitcoin-backed existence proof, stacked with (not replacing) the instant, legal-grade rfc3161 anchor. Calendars accept in milliseconds; the anchor entry is written immediately with a pending proof and upgrade_ots_anchor later folds the Bitcoin attestation in, idempotently, with a network failure leaving the anchor pending. The proof field is a standard detached .ots file (base64), readable by the reference ots client; verify_ots_anchor pins anchoredDigest to the receipt's signed payload (Section 6 rule 3) and confirms the proof commits it, offline. CLI: vaara receipt anchor-ots and vaara receipt upgrade-ots. New optional extra: pip install "vaara[ots]" (the opentimestamps library, for .ots interop). Zero recurring cost, no account, no third party under contract. The extra carries rfc8785, asn1crypto, and cryptography so vaara[ots] is self-sufficient (verified live against the public calendars in a clean environment).