v0.4.106–0.4.109 — privacy defaults, P2P hardening, sidebar perf

[kwalus]

Rolls up four patch releases since v0.4.105:

• 0.4.106 — Privacy-first trust baseline (unknown peers start at 0), feed defaults to private, visibility-scoped propagation with narrowing revocation
• 0.4.107 — Proactive P2P hardening pass: trust boundary enforcement, input validation, API auth tightening, feed visibility defaults
• 0.4.108 — Delete signal authorization, sidebar DOM batching and render-key diffing, GPU compositing hints
• 0.4.109 — Encryption helper robustness, metadata logging cleanup
• Docs — Updated README disclaimer, refreshed agent onboarding and API reference
• Tests — New regression tests for channels, streams, sidebar, workspace events