v4.0.0: codec 2.60.4 security release, --pq-box sealed-box mode, F-16 fix

Major release. Highlights:

- Codec: vendored VaptVupt codec moves to canonical 2.60.4 security
  release. Fixes a high-severity OOB heap write in the AVX2 decode fast
  path (reachable on a valid stream sized to exactly content_size, both
  tail variants). Brings CBMC-formally-verified BCJ filters with
  automatic ELF/PE/Mach-O detection. Compressed output stays
  byte-identical (ratio gate Δ 0.00%); wire format unchanged at v1.6.
- New --pq-box sealed-box recipient mode (vendored libpqvaptvupt 0.6.0):
  ML-KEM-768 + X25519 combined via HKDF-SHA256 with domain separation,
  AES-256-CTR + HMAC-SHA256 EtM. Legacy --pq and --pq-sdk stay readable.
- F-16: discloses and fixes a pre-existing data-loss defect in the
  <= 3.8.0 in-tree BCJ encoder. Full back-compat matrix decodes
  byte-exact under 4.0.0; every readable pre-4.0 archive remains readable.

Repository hygiene:
- Sync full 4.0.0 source tree (codec, crypto, SDK, GUI, packaging, tests).
- Remove internal scratch files (PROMPT.md, FORMAL_AUDIT_PROMPT.md)
  and superseded version-specific docs (INTEGRATION_PROTOCOL_2.60.4.md,
  docs/FINDINGS-2.x.md) and a stray test binary.
- Refresh README download/install section to real 4.0.0 release assets;
  bump version badge to 4.0.0.
- Add .gitignore for build outputs (keeps vendored prebuilt libraries).

packaging/build-gui-appimage.sh

@@ -13,44 +13,44 @@
 set -e
 cd "$(dirname "$0")/.."
 
-VERSION="${VERSION:-1.1.1}"
-APPDIR="/tmp/zupt-gui.AppDir"
+VERSION="${VERSION:-1.2.0}"
+APPDIR="/tmp/vaptvupt-gui.AppDir"
 
 rm -rf "$APPDIR"
 mkdir -p "$APPDIR/usr/bin" \
-         "$APPDIR/usr/lib/zupt-gui" \
+         "$APPDIR/usr/lib/vaptvupt-gui" \
          "$APPDIR/usr/share/applications" \
          "$APPDIR/usr/share/icons/hicolor/256x256/apps"
 
 # Python source
-install -m 644 gui/src/zupt_gui.py "$APPDIR/usr/lib/zupt-gui/"
+install -m 644 gui/src/zupt_gui.py "$APPDIR/usr/lib/vaptvupt-gui/"
 
 # Wrapper
-cat > "$APPDIR/usr/bin/zupt-gui" <<'WRAP'
+cat > "$APPDIR/usr/bin/vaptvupt-gui" <<'WRAP'
 #!/bin/sh
-exec python3 "$(dirname "$0")/../lib/zupt-gui/zupt_gui.py" "$@"
+exec python3 "$(dirname "$0")/../lib/vaptvupt-gui/zupt_gui.py" "$@"
 WRAP
-chmod 755 "$APPDIR/usr/bin/zupt-gui"
+chmod 755 "$APPDIR/usr/bin/vaptvupt-gui"
 
 # Desktop file
-cat > "$APPDIR/zupt-gui.desktop" <<'DESKTOP'
+cat > "$APPDIR/vaptvupt-gui.desktop" <<'DESKTOP'
 [Desktop Entry]
 Type=Application
-Name=Zupt GUI
+Name=VaptVupt GUI
 GenericName=Backup and Compression Utility
 Comment=Post-quantum backup with HKDF combiner, key commitment, HPKE binding
-Exec=zupt-gui %f
-Icon=zupt-gui
+Exec=vaptvupt-gui %f
+Icon=vaptvupt-gui
 Terminal=false
 Categories=Utility;Archiving;Compression;Security;
 StartupNotify=true
 DESKTOP
-cp "$APPDIR/zupt-gui.desktop" "$APPDIR/usr/share/applications/"
+cp "$APPDIR/vaptvupt-gui.desktop" "$APPDIR/usr/share/applications/"
 
 # Icon
 if [ -f gui/assets/zupt-icon.png ]; then
-    cp gui/assets/zupt-icon.png "$APPDIR/zupt-gui.png"
-    cp gui/assets/zupt-icon.png "$APPDIR/usr/share/icons/hicolor/256x256/apps/zupt-gui.png"
+    cp gui/assets/zupt-icon.png "$APPDIR/vaptvupt-gui.png"
+    cp gui/assets/zupt-icon.png "$APPDIR/usr/share/icons/hicolor/256x256/apps/vaptvupt-gui.png"
 else
     python3 -c "
 import struct, zlib
@@ -60,7 +60,7 @@ def png(w, h, color):
     return b'\\x89PNG\\r\\n\\x1a\\n' + chunk(b'IHDR', struct.pack('>IIBBBBB', w, h, 8, 2, 0, 0, 0)) + chunk(b'IDAT', zlib.compress(raw)) + chunk(b'IEND', b'')
 open('$APPDIR/zupt-gui.png','wb').write(png(256, 256, (88, 92, 215)))
 "
-    cp "$APPDIR/zupt-gui.png" "$APPDIR/usr/share/icons/hicolor/256x256/apps/zupt-gui.png"
+    cp "$APPDIR/vaptvupt-gui.png" "$APPDIR/usr/share/icons/hicolor/256x256/apps/vaptvupt-gui.png"
 fi
 
 # AppRun — sets PATH so zupt-gui finds the bundled wrapper, falls
@@ -73,7 +73,7 @@ export PATH="$HERE/usr/bin:$PATH"
 # Pre-flight check: is python3 available? Is a Qt6 binding installed?
 if ! command -v python3 >/dev/null 2>&1; then
     cat >&2 <<EOF
-zupt-gui: python3 is not installed.
+vaptvupt-gui: python3 is not installed.
 Install: sudo apt install python3   (Debian/Ubuntu)
          sudo dnf install python3   (Fedora/RHEL)
 EOF
@@ -83,7 +83,7 @@ fi
 if ! python3 -c 'import PyQt6.QtWidgets' 2>/dev/null \
    && ! python3 -c 'import PySide6.QtWidgets' 2>/dev/null; then
     cat >&2 <<EOF
-zupt-gui: needs a Qt6 Python binding (PyQt6 or PySide6).
+vaptvupt-gui: needs a Qt6 Python binding (PyQt6 or PySide6).
 Install one of:
   Debian/Ubuntu:  sudo apt install python3-pyqt6
   Fedora/RHEL:    sudo dnf install python3-pyqt6
@@ -92,30 +92,30 @@ EOF
     exit 1
 fi
 
-if ! command -v zupt >/dev/null 2>&1; then
+if ! command -v vaptvupt >/dev/null 2>&1 && ! command -v zupt >/dev/null 2>&1; then
     cat >&2 <<EOF
-zupt-gui: warning — the 'zupt' CLI was not found in PATH.
-Install the zupt package or place the binary in PATH.
+vaptvupt-gui: warning — neither 'vaptvupt' nor legacy 'zupt' CLI was found in PATH.
+Install the vaptvupt package or place the binary in PATH.
 The GUI will start but compress/extract operations will fail.
 EOF
 fi
 
-exec "$HERE/usr/bin/zupt-gui" "$@"
+exec "$HERE/usr/bin/vaptvupt-gui" "$@"
 APPRUN
 chmod 755 "$APPDIR/AppRun"
 
 # Build AppImage
 if command -v appimagetool >/dev/null 2>&1; then
-    ARCH=x86_64 appimagetool "$APPDIR" "/tmp/Zupt-GUI-$VERSION-x86_64.AppImage" 2>&1 | tail -5
-    echo "Built: /tmp/Zupt-GUI-$VERSION-x86_64.AppImage"
+    ARCH=x86_64 appimagetool "$APPDIR" "/tmp/VaptVupt-GUI-$VERSION-x86_64.AppImage" 2>&1 | tail -5
+    echo "Built: /tmp/VaptVupt-GUI-$VERSION-x86_64.AppImage"
 else
     cd /tmp
-    rm -f "Zupt-GUI-$VERSION-x86_64.AppDir.tar.gz"
-    tar -czf "Zupt-GUI-$VERSION-x86_64.AppDir.tar.gz" zupt-gui.AppDir
+    rm -f "VaptVupt-GUI-$VERSION-x86_64.AppDir.tar.gz"
+    tar -czf "VaptVupt-GUI-$VERSION-x86_64.AppDir.tar.gz" vaptvupt-gui.AppDir
     cd - >/dev/null
     echo "appimagetool unavailable; portable AppDir tarball at:"
-    echo "  /tmp/Zupt-GUI-$VERSION-x86_64.AppDir.tar.gz"
-    echo "Run via: tar -xzf ... && ./zupt-gui.AppDir/AppRun"
+    echo "  /tmp/VaptVupt-GUI-$VERSION-x86_64.AppDir.tar.gz"
+    echo "Run via: tar -xzf ... && ./vaptvupt-gui.AppDir/AppRun"
     echo "Convert to AppImage on a host with appimagetool:"
-    echo "  ARCH=x86_64 appimagetool zupt-gui.AppDir Zupt-GUI-$VERSION-x86_64.AppImage"
+    echo "  ARCH=x86_64 appimagetool vaptvupt-gui.AppDir VaptVupt-GUI-$VERSION-x86_64.AppImage"
 fi