v4.0.0: codec 2.60.4 security release, --pq-box sealed-box mode, F-16 fix

Major release. Highlights:

- Codec: vendored VaptVupt codec moves to canonical 2.60.4 security
  release. Fixes a high-severity OOB heap write in the AVX2 decode fast
  path (reachable on a valid stream sized to exactly content_size, both
  tail variants). Brings CBMC-formally-verified BCJ filters with
  automatic ELF/PE/Mach-O detection. Compressed output stays
  byte-identical (ratio gate Δ 0.00%); wire format unchanged at v1.6.
- New --pq-box sealed-box recipient mode (vendored libpqvaptvupt 0.6.0):
  ML-KEM-768 + X25519 combined via HKDF-SHA256 with domain separation,
  AES-256-CTR + HMAC-SHA256 EtM. Legacy --pq and --pq-sdk stay readable.
- F-16: discloses and fixes a pre-existing data-loss defect in the
  <= 3.8.0 in-tree BCJ encoder. Full back-compat matrix decodes
  byte-exact under 4.0.0; every readable pre-4.0 archive remains readable.

Repository hygiene:
- Sync full 4.0.0 source tree (codec, crypto, SDK, GUI, packaging, tests).
- Remove internal scratch files (PROMPT.md, FORMAL_AUDIT_PROMPT.md)
  and superseded version-specific docs (INTEGRATION_PROTOCOL_2.60.4.md,
  docs/FINDINGS-2.x.md) and a stray test binary.
- Refresh README download/install section to real 4.0.0 release assets;
  bump version badge to 4.0.0.
- Add .gitignore for build outputs (keeps vendored prebuilt libraries).

packaging/build-appimage.sh

@@ -1,49 +1,57 @@
 #!/bin/bash
 # SPDX-License-Identifier: AGPL-3.0-or-later
 # Copyright (c) 2025-2026 Cristian Cezar Moisés
-# Build zupt as AppImage (portable single-file binary).
+# Build vaptvupt CLI as AppImage (portable single-file binary).
+# Includes a legacy `zupt` symlink so AppDir users can invoke either name.
 set -e
 cd "$(dirname "$0")/.."
 
-VERSION="${VERSION:-2.2.3}"
+VERSION="${VERSION:-3.0.0}"
 ARCH="${ARCH:-x86_64}"
-NAME="zupt-$VERSION-$ARCH"
+PKGNAME="vaptvupt"
+LEGACY="zupt"
+NAME="$PKGNAME-$VERSION-$ARCH"
 OUT="/tmp/${NAME}.AppDir"
 
 rm -rf "$OUT"
 mkdir -p "$OUT/usr/bin" "$OUT/usr/lib" "$OUT/usr/share/applications" "$OUT/usr/share/icons/hicolor/256x256/apps"
 
-install -m 755 zupt "$OUT/usr/bin/"
+install -m 755 $PKGNAME "$OUT/usr/bin/$PKGNAME"
+ln -sf $PKGNAME "$OUT/usr/bin/$LEGACY"
 install -m 644 vendor/zuptsdk/libzuptsdk.so.2.0.0 "$OUT/usr/lib/"
 ln -sf libzuptsdk.so.2.0.0 "$OUT/usr/lib/libzuptsdk.so.2"
 ln -sf libzuptsdk.so.2 "$OUT/usr/lib/libzuptsdk.so"
+install -m 644 vendor/pqvaptvupt/libpqvaptvupt.so.0.6.0 "$OUT/usr/lib/"
+ln -sf libpqvaptvupt.so.0.6.0 "$OUT/usr/lib/libpqvaptvupt.so.0"
+ln -sf libpqvaptvupt.so.0 "$OUT/usr/lib/libpqvaptvupt.so"
 
-cat > "$OUT/AppRun" <<'APPRUN'
+cat > "$OUT/AppRun" <<APPRUN
 #!/bin/bash
-HERE="$(dirname "$(readlink -f "${0}")")"
-export LD_LIBRARY_PATH="$HERE/usr/lib:$LD_LIBRARY_PATH"
-export PATH="$HERE/usr/bin:$PATH"
-exec "$HERE/usr/bin/zupt" "$@"
+HERE="\$(dirname "\$(readlink -f "\${0}")")"
+export LD_LIBRARY_PATH="\$HERE/usr/lib:\$LD_LIBRARY_PATH"
+export PATH="\$HERE/usr/bin:\$PATH"
+exec "\$HERE/usr/bin/$PKGNAME" "\$@"
 APPRUN
 chmod +x "$OUT/AppRun"
 
-cat > "$OUT/zupt.desktop" <<'DESK'
+cat > "$OUT/$PKGNAME.desktop" <<DESK
 [Desktop Entry]
-Name=Zupt
-Comment=Post-quantum backup compression utility
-Exec=zupt
+Name=VaptVupt
+Comment=Post-quantum backup compression utility (formerly Zupt)
+Exec=$PKGNAME
 Terminal=true
 Type=Application
-Categories=Utility;Archiving;
-Icon=zupt
+Categories=Utility;Archiving;Security;
+Icon=$PKGNAME
 DESK
-cp "$OUT/zupt.desktop" "$OUT/usr/share/applications/"
+cp "$OUT/$PKGNAME.desktop" "$OUT/usr/share/applications/"
 
-printf '\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x06\x00\x00\x00\x1f\x15\xc4\x89\x00\x00\x00\rIDATx\x9cc\xfc\xcf\xc0\x00\x00\x00\x05\x00\x01\xa5\xf6E@\x00\x00\x00\x00IEND\xaeB`\x82' > "$OUT/zupt.png"
-cp "$OUT/zupt.png" "$OUT/usr/share/icons/hicolor/256x256/apps/zupt.png"
+# 1x1 PNG placeholder — replace with a real icon when the brand asset exists
+printf '\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x06\x00\x00\x00\x1f\x15\xc4\x89\x00\x00\x00\rIDATx\x9cc\xfc\xcf\xc0\x00\x00\x00\x05\x00\x01\xa5\xf6E@\x00\x00\x00\x00IEND\xaeB`\x82' > "$OUT/$PKGNAME.png"
+cp "$OUT/$PKGNAME.png" "$OUT/usr/share/icons/hicolor/256x256/apps/$PKGNAME.png"
 
 if command -v appimagetool >/dev/null 2>&1; then
-    ARCH=$ARCH appimagetool "$OUT" "/tmp/${NAME}.AppImage"
+    ARCH=$ARCH appimagetool "$OUT" "/tmp/${NAME}.AppImage" 2>&1 | tail -5
     echo "Built: /tmp/${NAME}.AppImage"
 fi
 
@@ -53,4 +61,4 @@ fi
 cd /tmp
 tar -czf "${NAME}.AppDir.tar.gz" "$(basename "$OUT")"
 echo "Built: /tmp/${NAME}.AppDir.tar.gz"
-echo "Users can run: tar xzf ${NAME}.AppDir.tar.gz && ./${NAME}.AppDir/AppRun"
+echo "Users can run: tar xzf ${NAME}.AppDir.tar.gz && ./${NAME}.AppDir/AppRun version"