v0.4.0

v0.4.0 — reorg safety and the relay's rough edges

The wallet now survives its chain being rewritten. Spent coins are marked
rather than deleted, so a rollback has something to restore; a reorg rolls
the wallet back through a crash-safe marker that fails closed in both
directions; a pending tombstone gains its height when the spend confirms.

Relay grows up: a damaged relay store is quarantined instead of silently
stopping sync, transactions are copyable (raw bytes withdrawn once
confirmed), every send stamps an anti-fee-sniping locktime matching Core's
distribution, and a disproportionate fee warns before signing. Slow peers
cool off exponentially instead of being banned for the session — the fix for
"peers are lagging me out" — and header persistence appends instead of
rewriting the whole file, which had made every sync slower than the last.

The cfcheckpt majority rule runs for the first time on a fixture tall enough
to reach it, and what it caught is recorded: evict-and-continue rather than
halt, and no trust for a peer that replaced an evicted liar. Signer
independence is proven structurally instead of sampled. CI stops asserting on
wall-clock time, and fork code stays off the persistent runner.