0.3.1 — Security & robustness pass

Multi-agent audit identified 16 bugs across the merge core, security boundary, threading, and build pipeline. All fixed in this release.

Security (path traversal & I/O)

• /mv inspect and /mv merge now validate replay paths via Path.toRealPath() against the Flashback replay root — symlink-based traversal blocked.
• Atomic-move TOCTOU window closed: re-check destination existence right before the final rename.
• Source replays with totalTicks <= 0 are rejected at open time.

Correctness / memory

• Chunk dedup migrated from CRC32C (32 bits) to SHA-256 prefix (128 bits). CRC32C had a ~1-in-256k birthday collision on long replays. Held in a ThreadLocal<MessageDigest> to avoid per-call alloc.
• chatRecentChatText now a bounded LRU (10k entries) — long sessions no longer risk OOM.
• streamMerge outer try/finally with a writer holder so the active SegmentWriter is always closed on the snapshot-copy phase.
• TimelineAligner guards against Integer.MAX_VALUE overflow on both per-source offsets and merged total ticks (loud failure vs silent negative timeline).
• Malformed marker keys in metadata.json no longer abort the merge.

UI / threading

• All client.execute callbacks in the merge flow now check client.screen == progressScreen — no more callbacks firing on the wrong screen if the user navigates away.
• Reflection failures on Flashback internals (renamed fields) now log WARN instead of being silently swallowed.
• Back-button callback null-checks Minecraft instance.
• MC 26.1 compatibility: probe Class.forName("GuiGraphics") up-front instead of registering and crashing later.

Build / CI

• build-version.sh propagates gradlew failure explicitly.
• multi-version-build.yml step uses set -e + explicit exit 1.

No new features, no API changes. Drop-in replacement for 0.3.0.