sdk: integrate libvuptsdk (renamed libzuptsdk); decouple --pq-box

libvuptsdk (git.securityops.co/cristiancmoises/libvuptsdk) is the renamed
libzuptsdk: only the .so filename/SONAME changed (libzuptsdk.so.2 ->
libvuptsdk.so.2); the C API (zuptsdk_* symbols, zuptsdk.h) is unchanged.

- Rename vendor/zuptsdk -> vendor/vuptsdk with libvuptsdk's headers.
- Makefile WITH_SDK=1 now links -lvuptsdk (+ its transitive libcrypto/libargon2
  deps via SDK_DEPLIBS) instead of -lzuptsdk, and installs libvuptsdk.so.*.
- DECOUPLE --pq-box: it needs the SEPARATE libpqvaptvupt, which libvuptsdk does
  NOT provide, so gate it behind a new WITH_PQBOX=1 (was folded into WITH_SDK).
  zupt_crypto_pqbox.c now keys on ZUPT_WITH_PQBOX; WITH_SDK=1 alone builds and
  links cleanly with just libvuptsdk and enables --pq-sdk + Argon2id.
- Banner/help renamed libzuptsdk -> libvuptsdk; the machine-readable 'Build:'
  line lists --pq-box only under WITH_PQBOX. GUI _get_caps matches on 'vuptsdk'.

Validated on Guix: WITH_SDK=1 links libvuptsdk + libcrypto + libargon2, runs,
banner 'Build: full (libvuptsdk: Argon2id, --pq-sdk available)', keygen --sdk +
--pq-sdk encrypt/decrypt byte-exact roundtrip. Default source-only build
unchanged (make check 16/16).

vendor/vuptsdk/include/vaptvupt.h

@@ -2,7 +2,7 @@
  * VaptVupt Codec — Next-generation lossless compression
  * Public API and data structures
  *
- * SPDX-License-Identifier: GPL-3.0-or-later
+ * SPDX-License-Identifier: AGPL-3.0-or-later
  * Copyright 2026 Cristian.
  * Zero dependencies. Pure C11.
  */

vendor/vuptsdk/include/vaptvupt_api.h

@@ -1,6 +1,6 @@
 /*
  * VaptVupt — Zupt Integration API
- * SPDX-License-Identifier: GPL-3.0-or-later
+ * SPDX-License-Identifier: AGPL-3.0-or-later
  * Copyright 2026 Cristian.
  *
  * ZUPT-COMPAT: This is the API that Zupt calls. It wraps the internal

vendor/vuptsdk/include/vv_ans.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-License-Identifier: GPL-3.0-or-later
+ * SPDX-License-Identifier: AGPL-3.0-or-later
  *
  * VaptVupt — tANS Entropy Codec (v2: sparse header + 4-way interleaved)
  *

vendor/vuptsdk/include/vv_huffman.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-License-Identifier: GPL-3.0-or-later
+ * SPDX-License-Identifier: AGPL-3.0-or-later
  *
  * VaptVupt — Canonical Huffman Codec
  *

vendor/vuptsdk/include/vv_platform.h

@@ -4,7 +4,7 @@
  * Provides unified abstractions for compiler intrinsics used throughout
  * the codebase. Supports GCC, Clang, MSVC, and Intel compilers.
  *
- * SPDX-License-Identifier: GPL-3.0-or-later
+ * SPDX-License-Identifier: AGPL-3.0-or-later
  */
 
 #ifndef VV_PLATFORM_H

vendor/vuptsdk/include/zupt.h

@@ -30,7 +30,7 @@
   #define zupt_mkdir(p) mkdir(p, 0755)
 #endif
 
-#define ZUPT_VERSION_STRING "2.2.3"
+#define ZUPT_VERSION_STRING "2.2.2"
 #define ZUPT_FORMAT_MAJOR   1
 #define ZUPT_FORMAT_MINOR   4
 
@@ -62,8 +62,8 @@
 /* Encryption types (stored in encryption header block) */
 #define ZUPT_ENC_PBKDF2     0x01  /* Password-based: PBKDF2 → AES-256-CTR + HMAC */
 #define ZUPT_ENC_PQ_HYBRID  0x02  /* ML-KEM-768 + X25519 hybrid KEM (legacy XOR+SHA3) */
-#define ZUPT_ENC_PQ_SDK_V2  0x03  /* libzuptsdk v2 header: HKDF combiner + commitment + HPKE binding */
-#define ZUPT_ENC_PW_ARGON2  0x04  /* Password-based via libzuptsdk: Argon2id + XChaCha20-Poly1305 */
+#define ZUPT_ENC_PQ_SDK_V2  0x03  /* libvuptsdk v2 header: HKDF combiner + commitment + HPKE binding */
+#define ZUPT_ENC_PW_ARGON2  0x04  /* Password-based via libvuptsdk: Argon2id + XChaCha20-Poly1305 */
 
 /* Block types */
 #define ZUPT_BLOCK_DATA       0x00
@@ -173,7 +173,7 @@ typedef struct {
     int level; uint32_t block_size; uint16_t codec_id;
     int verbose, encrypt, quiet, solid, threads;
     int pq_mode;           /* 1 = post-quantum hybrid KEM mode */
-    int sdk_mode;          /* 1 = use libzuptsdk-backed v3 crypto (HKDF combiner + commitment + HPKE) */
+    int sdk_mode;          /* 1 = use libvuptsdk-backed v3 crypto (HKDF combiner + commitment + HPKE) */
     int dedup;             /* 1 = block-level deduplication enabled */
     char password[256];
     char keyfile[ZUPT_MAX_PATH]; /* Path to .zupt-key file */
@@ -329,7 +329,7 @@ int zupt_hybrid_encrypt_init(zupt_keyring_t *kr, const char *pubkeyfile,
 int zupt_hybrid_decrypt_init(zupt_keyring_t *kr, const char *privkeyfile,
                               const uint8_t *enc_hdr, size_t enc_hdr_len);
 
-/* ─── SDK-backed crypto (zupt v2.2+, libzuptsdk under the hood) ─── */
+/* ─── SDK-backed crypto (zupt v2.2+, libvuptsdk under the hood) ─── */
 int zupt_sdk_hybrid_keygen(const char *privkeyfile, const char *pubkeyfile);
 int zupt_sdk_hybrid_encrypt_init(zupt_keyring_t *kr, const char *pubkeyfile,
                                   uint8_t *enc_hdr, size_t *enc_hdr_len);

vendor/vuptsdk/include/zupt_mlkem.h

@@ -21,6 +21,7 @@
 #define ZUPT_MLKEM_H
 
 #include <stdint.h>
+#include <stddef.h>
 
 #define MLKEM_K     3
 #define MLKEM_N     256
@@ -46,7 +47,8 @@ int zupt_mlkem768_keygen(uint8_t pk[MLKEM_PUBLICKEYBYTES],
  * ct: output ciphertext (1088 bytes)
  * ss: output shared secret (32 bytes)
  * pk: input public key (1184 bytes)
- * Returns 0 on success. */
+ * Returns 0 on success, non-zero if pk fails the FIPS 203 §7.2
+ * encapsulation-key modulus check (malformed key). */
 int zupt_mlkem768_encaps(uint8_t ct[MLKEM_CIPHERTEXTBYTES],
                           uint8_t ss[MLKEM_SSBYTES],
                           const uint8_t pk[MLKEM_PUBLICKEYBYTES]);
@@ -62,4 +64,14 @@ int zupt_mlkem768_decaps(uint8_t ss[MLKEM_SSBYTES],
                           const uint8_t ct[MLKEM_CIPHERTEXTBYTES],
                           const uint8_t sk[MLKEM_SECRETKEYBYTES]);
 
+/* FIPS 203 §7.2 encapsulation-key check (modulus check).
+ * Returns 0 iff `ek` is `len`==1184 bytes and every 12-bit coefficient is
+ * reduced mod q. Non-zero => malformed key; do not encapsulate against it. */
+int zupt_mlkem768_check_ek(const uint8_t *ek, size_t len);
+
+/* FIPS 203 §7.3 decapsulation-key check (hash check).
+ * Returns 0 iff `dk` is `len`==2400 bytes and the embedded H(ek) matches the
+ * SHA3-256 of the embedded encapsulation key. Non-zero => corrupt/forged key. */
+int zupt_mlkem768_check_dk(const uint8_t *dk, size_t len);
+
 #endif

vendor/vuptsdk/include/zuptsdk.h

@@ -1,10 +1,10 @@
 /*
- * libzuptsdk — Public C ABI for the Zupt backup compression library
+ * libvuptsdk — Public C ABI for the Zupt backup compression library
  *
  * Copyright (c) 2026 Cristian Cezar Moisés
  * SPDX-License-Identifier: AGPL-3.0-or-later
  *
- * Repository: https://git.securityops.co/cristiancmoises/zupt
+ * Repository: https://github.com/cristiancmoises/zupt
  * Website:    https://zupt.securityops.co
  * Contact:    zupt@riseup.net
  *
@@ -15,7 +15,7 @@
  * is gated behind the linker version tag ZUPTSDK_1.0. New symbols may be
  * added in minor versions (1.1, 1.2, ...) under new tags (ZUPTSDK_1.1, ...).
  * Existing symbols will never change signature within v1.x. Breaking
- * changes require a major version bump (libzuptsdk.so.2).
+ * changes require a major version bump (libvuptsdk.so.2).
  *
  * No symbol prefixed with anything other than `zuptsdk_` or `ZUPTSDK_` is
  * part of this ABI. Do not link against internal `zupt_*` symbols even if

vendor/vuptsdk/include/zuptsdk_easy.h

@@ -1,5 +1,5 @@
 /*
- * zuptsdk easy.h — high-level API for drop-in encryption.
+ * vuptsdk easy.h — high-level API for drop-in encryption.
  * SPDX-License-Identifier: AGPL-3.0-or-later
  *
  * Goal: 3 lines of code to encrypt/decrypt anything in any language.

vendor/vuptsdk/include/zuptsdk_metrics.h

@@ -1,4 +1,4 @@
-/* zuptsdk observability — metrics & structured logging hooks
+/* vuptsdk observability — metrics & structured logging hooks
  * SPDX-License-Identifier: AGPL-3.0-or-later
  */
 #ifndef ZUPTSDK_METRICS_H