v0.55.0

### Added

- **Pipecat transport — `siphon-ai-pipecat`** (`sdks/pipecat/`, design in
  `docs/design/DESIGN_PIPECAT.md`). Answer SiphonAI calls with a
  [Pipecat](https://www.pipecat.ai/) pipeline: `SiphonTransport.accept(websocket)` in a
  FastAPI endpoint, then `transport.input()` / `transport.output()` in the pipeline.
  Pipecat's stock WebSocket transport sends audio at 2× real time, which SiphonAI's
  200 ms playout window (PROTOCOL.md §5.5) cannot absorb. Measured against the daemon,
  a 3 s reply lost 65 frames (1.3 s) at 2× and none with this transport, which paces
  exact 20 ms frames at real time. The transport also sends `clear` on Pipecat
  interruptions, answers pause-mode arbitrations (Pipecat interrupts → confirm, no
  interruption by the deadline → `barge_in_reject`; while one is pending the bot's
  audio is held, then resumed on a schedule shifted by the daemon's exact pause so no
  backlog builds up (#620 tracks the daemon side for other real-time servers). Pause
  mode needs a word-based Pipecat interruption rule and a longer `decision_ms`, see
  the README), satisfies the start deadline
  for listen-first bots, hangs up when the pipeline ends after the caller has
  *heard* the last audio (a `mark` round-trip), maps DTMF both ways to Pipecat's
  native frames, and surfaces every other event as a typed `SiphonEventFrame`.
  Requires `pipecat-ai` 1.12–1.x. **No daemon or protocol change.**
  `transport.pipeline_params()` pins only the pipeline's input rate; TTS keeps its
  native output rate and the transport resamples to the call's.
- **`examples/pipecat-bot-py`** — Deepgram STT → OpenAI LLM → OpenAI TTS bot on the
  transport, with `end_call` / `transfer_call` tools, and an `--echo` mode (no
  provider keys) that CI now runs the full conformance testkit against.

### Documentation

- **The Debian 13 getting-started guide moved to `docs/GETTING_STARTED.md`** (from the
  repository root) and is linked from the README's install section.

### Security

- **sightglass: `ratatui` 0.29 → 0.30, clearing `lru` advisory
  [GHSA-rhfx-m35p-ff5j](https://github.com/advisories/GHSA-rhfx-m35p-ff5j)**
  (RUSTSEC-2026-0002 / RUSTSEC-2026-0253, low severity): `lru` 0.12's `IterMut` violated
  Stacked Borrows. The only path to it was `ratatui` 0.29 (no patched 0.29.x exists);
  0.30's `ratatui-core` uses `lru` 0.18. **The daemon is unaffected.** It never links
  ratatui, and the only change to what it builds is `bitflags` 2.11 → 2.13 (ratatui
  0.30 requires ^2.12). Sightglass needed no code changes, and its screens render
  identically: all six tabs at 120×40 and 80×24 were diffed character for character
  against 0.29. `cargo audit` also loses the unmaintained-`paste` warning.

---

**Artifacts**

- Static musl binaries for `x86_64` and `aarch64` (`.tar.gz`).
- Debian packages (`.deb`) for `amd64` and `arm64` — `apt install ./siphon-ai_*_amd64.deb`.
- `SHA256SUMS` — verify with `sha256sum -c SHA256SUMS`.
- `*-sbom.cdx.json` — CycloneDX SBOM.
- `SHA256SUMS.cosign.bundle` — cosign keyless signature over the checksums.
- Container: `ghcr.io/thevoiceguy/siphon-ai:v0.55.0` (multi-arch, cosign-signed).

Verify the checksums signature:
```
cosign verify-blob --bundle SHA256SUMS.cosign.bundle \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp 'release.yml@' SHA256SUMS
```