Add BRC-141 air-gap transport

[rohenaz]

Summary

• add a standalone, direct-import BSVAirGap product implementing BRC-141 version 1
• encode arbitrary 1–65,536 byte payloads as systematic fountain-coded air-gap: parts
• decode mixed/lossy camera streams with bounded sequence tracking and pending-equation budgets
• enforce strict Base64URL framing, session switching, shape validation, and complete-payload CRC-32
• keep QR rendering, camera capture, cadence, encryption, authentication, and application payload semantics out of the SDK codec

The product is intentionally not included in the broad BSV umbrella; applications opt in with import BSVAirGap.

Conformance

• all 31 official append-only BRC-141 vectors
• exact UInt32 seed-boundary parts, including the JavaScript precision boundary and 0xffffffff
• systematic and repair decoding, foreign-session switching, linear-dependence stall, malformed framing, and CRC reset
• direct regressions for the 65,536 sequence cap, 1,024 pending-part cap, 4,096 unresolved-reference cap, and mismatched body length
• fixture SHA-256: 9c99cfdd3a0c92ffb6635b724a592f1cd35c0dd0033af57385c44173c6a4950a

Verification

• focused AirGapConformanceTests: 8 passed
• complete SDK suite at final head: 808 passed
• independent review found no functional, security, wire-compatibility, fountain-decoding, or package-boundary defects
• git diff --check

Security boundary

BRC-141 supplies optical framing and accidental-corruption detection only. It does not provide confidentiality, sender authentication, or freshness. Wallets must seal/authenticate sensitive payloads before handing bytes to this codec, preflight the final 65,536-byte cap, and provide any reverse confirmation/acknowledgement channel at the application layer.

[rohenaz]

Independent standards pass against BRCs/peer-to-peer/0141.md at head 849d2ae4: no P1/P2 mismatch found. The 23-byte header, big-endian fields, strict unpadded base64url, 2,770-character predecode gate, exact UInt32 fountain seed math, three-part session switching, CRC reset, and bounded pending/sequence state match the normative spec. Shared seed-boundary/hostile-input vectors are included. All eight fresh macOS/Linux/Go/BigNum checks are green. Keep BRC-141 experimental until another implementation consumes the shared vectors, but I see no Swift-side blocker to undrafting.