v0.37.3

### Fixed

- **Outbound INVITE now carries the configured caller-ID in its From
  header** (issue #316; siphon-rs pin bump for `IntegratedUAC::
  invite_with_from`). Both `[[gateway]].from` and the per-originate
  `from` were honored for the WS `start` message and the CDR but **never
  reached the INVITE** — the UAC stamped its own local identity, so every
  outbound INVITE went out as `sip:siphon@<public_address>`. Any trunk
  that validates caller-ID (Twilio Secure Trunking, essentially every
  commercial provider) declined the call. The resolved caller-ID is now
  parsed and threaded through `OutboundOriginator::place` /
  `place_delayed` into a new per-call UAC From override, for both early
  and delayed offer. A malformed per-request `from` is rejected `400`
  (`BadFrom`) before a concurrency permit is taken; the gateway `from`
  stays validated at config load. This bug was **masked by #312** — before
  0.37.2 outbound TLS never completed the handshake, so the provider never
  parsed the From; with TLS fixed, this was the next wall. No protocol,
  config-schema, or CDR change (the WS/CDR `from` was already correct).

---

**Artifacts**

- Static musl binaries for `x86_64` and `aarch64` (`.tar.gz`).
- Debian packages (`.deb`) for `amd64` and `arm64` — `apt install ./siphon-ai_*_amd64.deb`.
- `SHA256SUMS` — verify with `sha256sum -c SHA256SUMS`.
- `*-sbom.cdx.json` — CycloneDX SBOM.
- `SHA256SUMS.cosign.bundle` — cosign keyless signature over the checksums.
- Container: `ghcr.io/thevoiceguy/siphon-ai:v0.37.3` (multi-arch, cosign-signed).

Verify the checksums signature:
```
cosign verify-blob --bundle SHA256SUMS.cosign.bundle \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp 'release.yml@' SHA256SUMS
```