v0.9.3

**Patch release — DTLS-SRTP on the outbound delayed-offer answer (RFC 5763).** Piece A of the DTLS-on-delayed follow-up (the inbound DTLS-offer side follows).

### Added
- **DTLS-SRTP on the outbound delayed-offer answer.** When SiphonAI dials an **offerless** outbound INVITE and the peer's 2xx offers DTLS-SRTP (`UDP/TLS/RTP/SAVPF` + `a=fingerprint` + `a=setup:actpass`), SiphonAI now **answers** it — running the inbound early-offer DTLS path inside the gateway UAC's answer generator (rewrite for codec matching, patch the answer back to the SAVPF profile with our `a=fingerprint` + opposite `a=setup`, `enable_dtls` as the handshake server). The generator gained a per-process DTLS certificate; the negotiated exchange (`dtls`/`sdes`) is carried on `OutboundAccepted` so `start.srtp.exchange` reports it correctly. Governed by `[[gateway]].srtp` like the SDES answer (0.9.1).

### Notes
- **DTLS on the *inbound* delayed-offer** (where SiphonAI would *offer* DTLS) is the next follow-up.

Verified live: gateway `srtp = "required"` + a peer DTLS-SRTP 2xx → the ACK answers DTLS (`a=fingerprint`), `outbound_srtp_total{result="encrypted"}` = 1. New SIPp `outbound_delayed_dtls` phase (signalling-only; the handshake/media path is forge-tested).

PR: #195.

🤖 Generated with [Claude Code](https://claude.com/claude-code)