v4.0.0: codec 2.60.4 security release, --pq-box sealed-box mode, F-16 fix

Major release. Highlights:

- Codec: vendored VaptVupt codec moves to canonical 2.60.4 security
  release. Fixes a high-severity OOB heap write in the AVX2 decode fast
  path (reachable on a valid stream sized to exactly content_size, both
  tail variants). Brings CBMC-formally-verified BCJ filters with
  automatic ELF/PE/Mach-O detection. Compressed output stays
  byte-identical (ratio gate Δ 0.00%); wire format unchanged at v1.6.
- New --pq-box sealed-box recipient mode (vendored libpqvaptvupt 0.6.0):
  ML-KEM-768 + X25519 combined via HKDF-SHA256 with domain separation,
  AES-256-CTR + HMAC-SHA256 EtM. Legacy --pq and --pq-sdk stay readable.
- F-16: discloses and fixes a pre-existing data-loss defect in the
  <= 3.8.0 in-tree BCJ encoder. Full back-compat matrix decodes
  byte-exact under 4.0.0; every readable pre-4.0 archive remains readable.

Repository hygiene:
- Sync full 4.0.0 source tree (codec, crypto, SDK, GUI, packaging, tests).
- Remove internal scratch files (PROMPT.md, FORMAL_AUDIT_PROMPT.md)
  and superseded version-specific docs (INTEGRATION_PROTOCOL_2.60.4.md,
  docs/FINDINGS-2.x.md) and a stray test binary.
- Refresh README download/install section to real 4.0.0 release assets;
  bump version badge to 4.0.0.
- Add .gitignore for build outputs (keeps vendored prebuilt libraries).

tests/test_codec_exact_size.sh

@@ -0,0 +1,52 @@
+#!/bin/bash
+# SPDX-License-Identifier: AGPL-3.0-or-later
+# Copyright (c) 2026 Cristian Cezar Moisés
+#
+# Exact-content_size decode OOB regression (codec 2.60.4 fix) under ASan,
+# plus a tool-level BCJ roundtrip on a real binary fixture at the levels
+# where the auto-filter engages. Codec sources are compiled directly with
+# -fsanitize=address (never link sanitized objects against the project's
+# non-sanitized .o files — ASan static-archive poisoning).
+
+set -u
+ARCH=$(uname -m)
+SIMD=""
+[ "$ARCH" = "x86_64" ] && SIMD="-mavx2"
+
+TMP=$(mktemp -d)
+rc=0
+
+echo "Codec exact-size + BCJ roundtrip"
+
+if gcc -Iinclude -Wall -Wextra -Werror -O1 -g -std=c11 -fsanitize=address $SIMD \
+       tests/test_codec_exact_size.c \
+       src/vaptvupt_api.c src/vv_ans.c src/vv_bcj.c src/vv_decoder.c \
+       src/vv_encoder.c src/vv_huffman.c src/vv_simd.c src/vv_xxh64.c \
+       -o "$TMP/t" 2>"$TMP/cc.log"; then
+    "$TMP/t"; rc=$?
+else
+    echo "  ✗ exact-size test failed to compile"; head -12 "$TMP/cc.log" | sed 's/^/    /'; rc=1
+fi
+
+# Tool-level BCJ roundtrip: real binary fixture at L5 (BALANCED+auto-filter)
+# and L9 (EXTREME+auto-filter); byte-exact extraction required. Guards the
+# F-16 defect class (old in-tree BCJ wrote undecodable streams).
+FX=/tmp/bench/fixtures/binary.dat
+if [ -f "$FX" ] && [ -x ./vaptvupt ]; then
+    for L in 5 9; do
+        rm -rf "$TMP/o$L"; mkdir -p "$TMP/o$L"
+        ./vaptvupt c -l $L "$TMP/a$L.zupt" "$FX" >/dev/null 2>&1
+        ./vaptvupt x -o "$TMP/o$L" "$TMP/a$L.zupt" >/dev/null 2>&1
+        F=$(find "$TMP/o$L" -type f | head -1)
+        if [ -n "$F" ] && diff -q "$F" "$FX" >/dev/null 2>&1; then
+            echo "  ✓ BCJ roundtrip L$L (binary fixture) byte-exact"
+        else
+            echo "  ✗ BCJ roundtrip L$L FAILED"; rc=1
+        fi
+    done
+else
+    echo "  - BCJ tool roundtrip skipped (fixture or binary missing)"
+fi
+
+rm -rf "$TMP"
+exit $rc