v0.3.0

v0.3.0 — the security epic

Fifty-odd commits of adversarial hardening across every invariant the wallet
claims, produced under a standing rule: every guard observed failing before
it was believed, mutations run against every new test.

The money path: the pre-broadcast gate authorizes the payment outputs
themselves — not just fee and inputs — send and bump reviews bind to exactly
what gets signed, stale or mutated reviews fail closed, spending operations
are mutually exclusive, and vault economics are validated inside core
signing. Vaults: signers must be distinct keys (relabelling included), every
2-of-3 signing pair proven end to end, MuSig2 nonces one-use and
interruption-safe, taproot tree depth bounded at parse.

The read side: damaged wallet, vault, header, and relay storage each fail
closed and distinctly; disagreeing peers cannot advance the scan; reorgs
become visible to their consumers; hostile PSBT and import-bundle parsing is
bounded and linear; a deterministic fuzz runner covers nine surfaces.

The app: wallet secrets require authentication to create, import, sign, and
export; the app switcher sees a cover, not a balance; clipboard copies carry
stated policies; the E2E journal is inspected by value, so a seed filed under
any field name is refused; release archives are gated against E2E controls.

The paper trail ships with the code: the limited-mainnet gate report, the
invariant matrix, and the findings register — verdict NO-GO, on evidence,
with the reasoning public. MIT licensed.