[kongesque]

Summary

Harden message and media sends so attachment keys and filenames stay inside authenticated encrypted payloads, native encrypted images fail before upload while their CTR stream reuse remains unresolved, and plaintext requires explicit per-send consent backed by server capability evidence. Interactive users can confirm eligible plaintext sends; scripts and JSON/stdin commands never prompt, and mutations are never replayed.

Reject authenticated HTTP redirects, bound response bodies and SSE accumulation, and pin Go 1.27.2 with release artifact vulnerability scans. Add synthetic regression coverage and document authorized live capability and plaintext delivery verification, including the remaining encrypted-file interoperability limitation.

Validation

• GitHub CI passed on macOS, Linux, and Windows, including runner/LTSM regressions.
• Local CLI/session/messaging/events/E2EE race tests, vet, Staticcheck v0.8.2, native build/help, and goimports formatting checks passed. The protocol race suite required a rerun outside the sandbox because its loopback HTTP server was blocked.
• Earlier full crypto, fuzz, and release-target validation is recorded in docs/SECURITY-CHANGES.md.
• No live LINE actions were performed for this PR publication.