v0.16.0

Fixed

• proc.ClaimSpawnedSessionIdentity now duplicates the inherited session
  descriptor before inspection and leaves the original descriptor and flags
  untouched unless the exact ownership proof succeeds.
• Spawned-session ownership is bound to the direct manager parent through
  kernel AF_UNIX peer credentials, independently captured process identity,
  and the exact v1 bootstrap, receipt, acknowledgement, and nonce exchange.
  Reparented sessions, foreign peers, malformed acknowledgements, and partial
  proofs fail without transferring or damaging descriptor ownership.