v0.48.7

### Fixed

- **The forge histograms actually render buckets now** (issue #437). The 0.48.6 note below claimed the forge-media bump gave "every forge histogram explicit buckets"; that was wrong for this daemon's own `/metrics` — a 0.48.6 instance still rendered `forge_vad_neural_inference_seconds` as a Prometheus summary (quantiles), unaggregatable across instances. `describe_*!` HELP text travels through the `metrics` facade to whatever recorder is installed, but bucket registration is **exporter-side**: forge-media #102 could only export suggested-bucket consts, and `prometheus_builder()` never applied them. It now registers forge-engine's exported buckets for the only two forge histogram families the consumed forge crates emit — `forge_vad_neural_inference_seconds` and `forge_transcoding_duration_seconds` (the conference/webrtc/sdp histograms live in forge-conference and forge-api, which SiphonAI deliberately doesn't consume) — referencing the upstream consts directly so name and buckets track the pin by construction, with a rendered-output test alongside the #431 suite. DEPLOY.md's forge row now points at forge-media's `docs/METRICS.md` and names the two bucketed families.

---

**Artifacts**

- Static musl binaries for `x86_64` and `aarch64` (`.tar.gz`).
- Debian packages (`.deb`) for `amd64` and `arm64` — `apt install ./siphon-ai_*_amd64.deb`.
- `SHA256SUMS` — verify with `sha256sum -c SHA256SUMS`.
- `*-sbom.cdx.json` — CycloneDX SBOM.
- `SHA256SUMS.cosign.bundle` — cosign keyless signature over the checksums.
- Container: `ghcr.io/thevoiceguy/siphon-ai:v0.48.7` (multi-arch, cosign-signed).

Verify the checksums signature:
```
cosign verify-blob --bundle SHA256SUMS.cosign.bundle \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp 'release.yml@' SHA256SUMS
```