v5.0.0: version bump, audit fixes, documentation overhaul

Version bumped to 5.0.0 across include/zupt.h, all packaging recipes, man
page, and docs.

Audit fixes (pre-5.0.0 review):
- src/zupt_format.c: overflow-safe bound in the solid-mode `test` path
  (off+sz could wrap and drive an OOB read in zupt_xxh64 on a crafted archive;
  the extract path was already hardened, the test path was not).
- gui: run_async now marshals the completion callback onto the GUI thread with
  QueuedConnection (a bare functor connected DirectConnection and touched
  widgets off the worker thread); Extract auto-detect note survives the log
  clear via a new `info` param.
- .github/workflows/ci.yml: trigger on `master` (was main/develop, so CI never
  ran); `make dist` tarball is vaptvupt-*.tar.gz not zupt-*; the ASAN PQ
  round-trip uses native --pq (was --pq-sdk, which fails on the source-only
  build and blocked the release job).

Documentation:
- New AUDIT.md (methodology, FIPS 203 conformance validation, findings, repro).
- CHANGELOG 5.0.0 entry covers the FIPS 203 conformance fix + BREAKING note and
  the GUI/CLI/security/packaging work.
- README "What's new in 5.0.0", download tables (incl. Windows/macOS/BSD +
  portable GUI), version-history row.
- SECURITY.md + THREAT_MODEL.md: ML-KEM-768 documented as FIPS 203, validated
  byte-for-byte against OpenSSL 3.5.
- Accuracy fixes: man page (--kdf default is PBKDF2 on source-only; codec
  2.60.4), rpm %description, debian control/copyright, homebrew header
  (no vendored library on source-only builds).

make check 16/16 (FIPS 203 conformance 3/3, all distro-safe checks).

gui/README.md

@@ -116,7 +116,7 @@ The GUI calls the vaptvupt CLI binary — all cryptography runs in native C, not
 
 ## Credits
 
-- **vaptvupt** v4.2.1 — Cristian Cezar Moisés ([github](https://git.securityops.co/cristiancmoises/vaptvupt))
+- **vaptvupt** v5.0.0 — Cristian Cezar Moisés ([github](https://git.securityops.co/cristiancmoises/vaptvupt))
 
 ## License
 

gui/src/zupt_gui.py

@@ -398,10 +398,14 @@ class PathField(QWidget):
 def scrollable(w):
     sa = QScrollArea(); sa.setWidgetResizable(True); sa.setWidget(w); sa.setFrameShape(QFrame.Shape.NoFrame); return sa
 
-def run_async(parent, cmd, btn, log, progress=None):
-    log.clear(); btn.setEnabled(False)
+def run_async(parent, cmd, btn, log, progress=None, info=None):
+    log.clear()
+    if info:  # e.g. an auto-detect note; appended AFTER the clear so it survives
+        log.append(info)
+    btn.setEnabled(False)
     if progress: progress.show()
     t = QThread(); w = Worker(cmd); w.moveToThread(t)
+    # log.append targets a main-thread QObject -> Qt queues it to the GUI thread.
     w.log.connect(log.append)
     # Keep a LIST of live (thread, worker) refs on the parent. Tabs with more
     # than one action button (Disk: backup + restore) previously shared a
@@ -417,7 +421,10 @@ def run_async(parent, cmd, btn, log, progress=None):
         log.append("\nDone." if code == 0 else f"\nFailed (exit {code}).")
         t.quit()
         parent._jobs = [(th, wk) for (th, wk) in parent._jobs if th is not t]
-    w.done.connect(finish)
+    # `done` is emitted from the worker thread and `finish` touches GUI widgets;
+    # a bare functor would connect DirectConnection and run OFF the GUI thread.
+    # QueuedConnection marshals it onto the GUI event loop.
+    w.done.connect(finish, Qt.ConnectionType.QueuedConnection)
     t.started.connect(w.run); t.start()
 
 # ── Tabs ──
@@ -621,6 +628,7 @@ class ExtractTab(QWidget):
         arc = self.arc.path()
         if not arc: QMessageBox.warning(self, "VaptVupt", "Select an archive."); return
         cmd = ["extract"]
+        info = None
         if self.out.path(): cmd += ["-o", self.out.path()]
         if self.pw.text(): cmd += ["-p", self.pw.text()]
         if self.pq.path():
@@ -629,11 +637,11 @@ class ExtractTab(QWidget):
                 # The private-key format must match how the archive was encrypted;
                 # inspect the header (vaptvupt info) to choose the right flag.
                 tok = _detect_archive_pq(arc) or "pq"
-                self.log.append(f"[auto-detect] using {_PQ_FLAG[tok][1]}")
+                info = f"[auto-detect] using {_PQ_FLAG[tok][1]}"
             _, flag = _PQ_FLAG[tok]
             cmd += [flag, self.pq.path()]
         cmd.append(arc)
-        run_async(self, cmd, self.btn, self.log, self.progress)
+        run_async(self, cmd, self.btn, self.log, self.progress, info=info)
 
 
 class VerifyTab(QWidget):