v0.37.0

### Added

- **Neural (Silero) VAD backend — `[media].vad = "energy" | "neural"`** with a per-route `[route.media].vad` override (strict replace, both directions, validated at config load). `"neural"` runs forge-vad's new Silero backend (forge-media #86: local tract-onnx inference, no network, ~60–80 µs per 32 ms window) for materially fewer acoustic false positives — coughs, keyboard clatter, music-on-hold bleed — before pause-mode barge-in arbitration even arms. Sessions are allocated before codec negotiation, so a neural detector is created at 16 kHz and re-aligned to the **negotiated** bridge rate at setup time (fixing the latent default-16 kHz-on-8 kHz mismatch; the delayed-offer and outbound paths re-align at `apply_answer`). The default `"energy"` keeps pre-0.37 detection byte-identical, including no per-session engine config. **WS protocol, `speech_started`/`speech_stopped` events, and CDR are unchanged** — the backend changes detection quality only. forge-media pin bumped to `1c996ae5fb4f` with `features = ["neural-vad"]` (tract is pure Rust; the static-musl multi-arch release build is the acceptance gate). Closes the siphon-ai half of the ROADMAP P2 "Neural VAD upgrade" item; rollout gate stays real-call false-barge-in rates under `mode = "pause"` + `debounce_ms` via the existing barge-in metrics. See `docs/CONFIG.md` `[media].vad`.

---

**Artifacts**

- Static musl binaries for `x86_64` and `aarch64` (`.tar.gz`).
- Debian packages (`.deb`) for `amd64` and `arm64` — `apt install ./siphon-ai_*_amd64.deb`.
- `SHA256SUMS` — verify with `sha256sum -c SHA256SUMS`.
- `*-sbom.cdx.json` — CycloneDX SBOM.
- `SHA256SUMS.cosign.bundle` — cosign keyless signature over the checksums.
- Container: `ghcr.io/thevoiceguy/siphon-ai:v0.37.0` (multi-arch, cosign-signed).

Verify the checksums signature:
```
cosign verify-blob --bundle SHA256SUMS.cosign.bundle \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp 'release.yml@' SHA256SUMS
```