v4.0.0: codec 2.60.4 security release, --pq-box sealed-box mode, F-16 fix

Major release. Highlights:

- Codec: vendored VaptVupt codec moves to canonical 2.60.4 security
  release. Fixes a high-severity OOB heap write in the AVX2 decode fast
  path (reachable on a valid stream sized to exactly content_size, both
  tail variants). Brings CBMC-formally-verified BCJ filters with
  automatic ELF/PE/Mach-O detection. Compressed output stays
  byte-identical (ratio gate Δ 0.00%); wire format unchanged at v1.6.
- New --pq-box sealed-box recipient mode (vendored libpqvaptvupt 0.6.0):
  ML-KEM-768 + X25519 combined via HKDF-SHA256 with domain separation,
  AES-256-CTR + HMAC-SHA256 EtM. Legacy --pq and --pq-sdk stay readable.
- F-16: discloses and fixes a pre-existing data-loss defect in the
  <= 3.8.0 in-tree BCJ encoder. Full back-compat matrix decodes
  byte-exact under 4.0.0; every readable pre-4.0 archive remains readable.

Repository hygiene:
- Sync full 4.0.0 source tree (codec, crypto, SDK, GUI, packaging, tests).
- Remove internal scratch files (PROMPT.md, FORMAL_AUDIT_PROMPT.md)
  and superseded version-specific docs (INTEGRATION_PROTOCOL_2.60.4.md,
  docs/FINDINGS-2.x.md) and a stray test binary.
- Refresh README download/install section to real 4.0.0 release assets;
  bump version badge to 4.0.0.
- Add .gitignore for build outputs (keeps vendored prebuilt libraries).

.gitignore

@@ -0,0 +1,51 @@
+# Build outputs
+/vaptvupt
+/zupt
+*.o
+*.a
+*.so
+*.so.*
+*.dylib
+# ...but keep vendored prebuilt libraries (shipped, no in-tree source)
+!vendor/**/*.so
+!vendor/**/*.so.*
+*.exe
+*.obj
+*.lib
+
+# Coverage / profiling
+*.gcda
+*.gcno
+*.gcov
+*.profraw
+
+# CMake / out-of-tree build dirs
+/build/
+/cmake-build-*/
+CMakeCache.txt
+CMakeFiles/
+
+# Distribution tarballs and packages (published as release assets, not committed)
+/*.tar.gz
+/*.tar.xz
+/*.zip
+/*.deb
+/*.rpm
+/*.AppImage
+*.AppDir/
+SHA256SUMS.txt
+
+# Test/scratch binaries
+/test_*
+!/tests/test_*.c
+!/tests/test_*.sh
+
+# Editor / OS noise
+*.swp
+*~
+.DS_Store
+.idea/
+.vscode/
+
+# AI assistant scratch
+.claude/