Changelog

v0.3.0 (unreleased)

Add MetamorphicCrypto.Hash — SHA-3 / SHA-2 hashing for public data (key fingerprints, safety numbers, key-transparency-log entries):
- sha3_512/1 (recommended default, Cat-5), sha3_256/1, sha256/1, sha512/1, and the domain-separated sha3_512_with_context/2 — plus ! raising variants.
- Base64 in, base64 out, matching the rest of the package and the WASM wire format, so a digest computed in Elixir is byte-for-byte identical to one computed in the browser/native (verified by a locked parity vector).
- MetamorphicCrypto.sha3_512/1 and MetamorphicCrypto.sha3_512_with_context/2 added to the top-level convenience facade.
These digests are for public data only and intentionally add no zeroize/constant-time ceremony; do not hash secrets with them (use MetamorphicCrypto.KDF.derive_session_key/2 for secret material).
Sync the native crate dependency to metamorphic-crypto 0.4.0, which exposes the public hashing API. No change to existing encryption behavior or wire formats.

No functional or API changes; encryption output is unchanged.
Sync the native crate dependency to metamorphic-crypto 0.3.7, deduping the sha3/keccak tree for a cleaner SBOM.
Supply-chain hardening of the release pipeline: SHA-pinned actions, build-provenance attestation of each precompiled NIF, cargo audit gate, grouped Dependabot, and a SECURITY.md.
Packaging: exclude the maintainer-only release task from the published package.

Add MetamorphicCrypto.Hybrid.security_level/0 type (:cat3 | :cat5)
MetamorphicCrypto.Hybrid.generate_keypair/1 now accepts an optional security level — generate_keypair(:cat5) for ML-KEM-1024, generate_keypair() for ML-KEM-768 (default, unchanged behavior)
MetamorphicCrypto.Hybrid.seal/3 and seal_raw/3 now accept an optional security level parameter
MetamorphicCrypto.Seal.seal_for_user/3 and seal_for_user_raw/3 now accept a :level option (:cat3 or :cat5) for choosing the PQ security level when a PQ public key is provided
Existing generate_keypair_1024/0, seal_1024/2, and seal_raw_1024/2 are preserved as convenience aliases
All changes are backwards compatible — no NIF or binary changes required

Switch from vendored metamorphic-crypto Rust source to metamorphic-crypto v0.2.0 on crates.io (no user-facing changes — the public Elixir API is fully backwards compatible)
Add ML-KEM-1024 + X25519 (Cat-5, NIST Category 5, ~AES-256) hybrid encryption:
- MetamorphicCrypto.Hybrid.generate_keypair_1024/0 — generate Cat-5 keypair
- MetamorphicCrypto.Hybrid.seal_1024/2 — encrypt with Cat-5
- MetamorphicCrypto.Hybrid.seal_raw_1024/2 — encrypt raw bytes with Cat-5
MetamorphicCrypto.Hybrid.open/2 now auto-detects Cat-3 (v2) and Cat-5 (v3) ciphertext
MetamorphicCrypto.Hybrid.hybrid_ciphertext?/1 now detects both v2 and v3 formats

Add explicit targets list to RustlerPrecompiled config
- Prevents download attempts for unsupported platforms (e.g. arm-unknown-linux-gnueabihf)
- mix rustler_precompiled.download --all now only fetches the 5 supported targets

Fix precompiled NIF loading on macOS and Windows
- Binary inside tar archive was named incorrectly (libmetamorphic_crypto_nif.dylib instead of the versioned .so name that RustlerPrecompiled expects)
- Users without Rust installed would get nif_not_loaded errors