v4.0.0: codec 2.60.4 security release, --pq-box sealed-box mode, F-16 fix

Major release. Highlights:

- Codec: vendored VaptVupt codec moves to canonical 2.60.4 security
  release. Fixes a high-severity OOB heap write in the AVX2 decode fast
  path (reachable on a valid stream sized to exactly content_size, both
  tail variants). Brings CBMC-formally-verified BCJ filters with
  automatic ELF/PE/Mach-O detection. Compressed output stays
  byte-identical (ratio gate Δ 0.00%); wire format unchanged at v1.6.
- New --pq-box sealed-box recipient mode (vendored libpqvaptvupt 0.6.0):
  ML-KEM-768 + X25519 combined via HKDF-SHA256 with domain separation,
  AES-256-CTR + HMAC-SHA256 EtM. Legacy --pq and --pq-sdk stay readable.
- F-16: discloses and fixes a pre-existing data-loss defect in the
  <= 3.8.0 in-tree BCJ encoder. Full back-compat matrix decodes
  byte-exact under 4.0.0; every readable pre-4.0 archive remains readable.

Repository hygiene:
- Sync full 4.0.0 source tree (codec, crypto, SDK, GUI, packaging, tests).
- Remove internal scratch files (PROMPT.md, FORMAL_AUDIT_PROMPT.md)
  and superseded version-specific docs (INTEGRATION_PROTOCOL_2.60.4.md,
  docs/FINDINGS-2.x.md) and a stray test binary.
- Refresh README download/install section to real 4.0.0 release assets;
  bump version badge to 4.0.0.
- Add .gitignore for build outputs (keeps vendored prebuilt libraries).

packaging/aur/PKGBUILD

@@ -0,0 +1,64 @@
+# Maintainer: Cristian Cezar Moisés <sac@securityops.co>
+#
+# AUR submission instructions:
+#   1. Run `make dist` upstream to produce zupt-VERSION.tar.gz.
+#   2. Upload that tarball somewhere stable (GitHub release / git.securityops.co).
+#   3. Update `source=()` URL and `sha256sums=()` below.
+#   4. Run `makepkg --printsrcinfo > .SRCINFO` in this directory.
+#   5. Commit and push to ssh://aur@aur.archlinux.org/zupt.git
+#
+# Test locally: `makepkg -s` in this directory after dropping a copy of the
+# zupt-VERSION.tar.gz alongside the PKGBUILD.
+
+pkgname=vaptvupt
+pkgver=4.0.0
+pkgrel=1
+provides=('zupt')
+replaces=('zupt')
+conflicts=('zupt')
+pkgdesc='Pure-C11 post-quantum backup compression utility (AES-256-CTR + HMAC-SHA256 + ML-KEM-768 + X25519)'
+arch=('x86_64' 'aarch64')
+url='https://git.securityops.co/cristiancmoises/zupt'
+license=('AGPL-3.0-or-later')
+depends=('glibc')
+makedepends=('gcc')
+checkdepends=('python')
+
+# Replace SHA256 placeholder with output of:
+#   sha256sum /tmp/zupt-2.4.4.tar.gz
+source=("${pkgname}-${pkgver}.tar.gz::https://git.securityops.co/cristiancmoises/zupt/releases/download/v${pkgver}/${pkgname}-${pkgver}.tar.gz")
+sha256sums=('SKIP')
+
+build() {
+    cd "${pkgname}-${pkgver}"
+    # Strict-warning build that the project's own §6 verification matrix uses.
+    CFLAGS="${CFLAGS:--O2 -std=c11} -Wall -Wextra -Wpedantic" \
+        make -j"$(nproc)"
+}
+
+check() {
+    cd "${pkgname}-${pkgver}"
+    # Project regression suite — F-06 HMAC, F-08 top-MAC, F-09 byte sweep, etc.
+    make test
+}
+
+package() {
+    cd "${pkgname}-${pkgver}"
+    make DESTDIR="${pkgdir}" PREFIX=/usr install
+
+    # Docs that aren't part of `make install`
+    install -Dm644 README.md         "${pkgdir}/usr/share/doc/${pkgname}/README.md"
+    install -Dm644 SECURITY.md       "${pkgdir}/usr/share/doc/${pkgname}/SECURITY.md"
+    install -Dm644 CHANGELOG.md      "${pkgdir}/usr/share/doc/${pkgname}/CHANGELOG.md"
+    install -Dm644 AUDIT.md          "${pkgdir}/usr/share/doc/${pkgname}/AUDIT.md"
+    install -Dm644 LICENSE           "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
+
+    # Vendored libzuptsdk shipped alongside the binary because the binary
+    # is linked with -Wl,-rpath,$ORIGIN/vendor/zuptsdk. For system install
+    # we move it to /usr/lib/zupt/ and the binary's rpath remains relative.
+    install -d "${pkgdir}/usr/lib/${pkgname}"
+    install -Dm755 vendor/zuptsdk/libzuptsdk.so.2.0.0 \
+        "${pkgdir}/usr/lib/${pkgname}/libzuptsdk.so.2.0.0"
+    ln -sf libzuptsdk.so.2.0.0 "${pkgdir}/usr/lib/${pkgname}/libzuptsdk.so.2"
+    ln -sf libzuptsdk.so.2.0.0 "${pkgdir}/usr/lib/${pkgname}/libzuptsdk.so"
+}