v0.31.1

### Security

- **siphon-rs bumped to `f3454c7`**, picking up upstream **#61**: a
  registration-hijack authentication-bypass fix plus remote parser
  panic fixes. Deployments using `[[register]]` / digest auth should
  update.

### Changed

- **forge-media bumped to `3c59b5f`** (lockstep with siphon-rs):
  dependency migrations — rand 0.10, openssl 0.10.81, and SRTP moving
  to aes 0.9 / aes-gcm 0.11 (cipher 0.5). Wire behavior is unchanged;
  the SIPp SRTP-SDES and DTLS scenarios pass against the new cipher
  stack.
- **`metrics` facade 0.23 → 0.24** (+ `metrics-exporter-prometheus`
  0.15 → 0.18) so forge and the daemon share one metrics recorder —
  forge moved to metrics 0.24, and a version-split facade would have
  silently dropped every `forge_*` series from `/metrics`. No metric
  names or labels changed.

No protocol, CDR, config, or API changes — a dependency-only patch.

---

**Artifacts**

- Static musl binaries for `x86_64` and `aarch64` (`.tar.gz`).
- Debian packages (`.deb`) for `amd64` and `arm64` — `apt install ./siphon-ai_*_amd64.deb`.
- `SHA256SUMS` — verify with `sha256sum -c SHA256SUMS`.
- `*-sbom.cdx.json` — CycloneDX SBOM.
- `SHA256SUMS.cosign.bundle` — cosign keyless signature over the checksums.
- Container: `ghcr.io/thevoiceguy/siphon-ai:v0.31.1` (multi-arch, cosign-signed).

Verify the checksums signature:
```
cosign verify-blob --bundle SHA256SUMS.cosign.bundle \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp 'release.yml@' SHA256SUMS
```