Framing and sampling hardening nits from pre-outreach dry-run review

[the-sarge]

Low/nit hardening and provenance notes surfaced by the internal pre-outreach dry-run review of issues #30/#31 (fresh-context AI pass; recorded as hygiene, not external review). The framing reviews found no injectivity or rejection-completeness defects; these are optional robustness/clarity items.

• Wire-versioning policy paragraph: format byte 0xc1, suite byte, and role byte are three fail-closed version axes, but no doc states the intended evolution path (new layout bumps format byte, new ciphersuite bumps suite byte). Add a short paragraph to README.md or docs/threat-model.md.
• readLEB128 (length_value.go): overflow safety relies on the only caller passing maxBytes=3; a future caller passing >=10 could shift into the sign bit and produce a negative length. Add an explicit maxBytes guard or compile-time assertion so the invariant is enforced, not documented.
• Encoder-side cap assertions: encodeMessage{A,B,C} trust upstream validation; over-cap AD encodes fine and only fails at the peer's decode. Consider a belt-and-suspenders encode-side assertion or a documented internal invariant.
• confirmationTag mac-key uses raw concatenation "CPaceMac" || sid || isk (the one deviation from the lvCat discipline); injective only because ISK is fixed at 64 bytes. Add a comment/doc note tying that safety to the suite-level ISK-length invariant.
• 64 KiB AD cap posture: the "digest, not payload" steer is documentation-only and both messages carry AD (~128 KiB per exchange). Decide: document 64 KiB as a deliberate ceiling with rationale, or expose an opt-in lower cap (the latter reopens API policy).
• README backstop wording: "malformed framed inputs also hit a 128 KiB aggregate decoder backstop" reads as if all malformed inputs hit it; only oversized ones do, after O(1) header validation. Align with the clearer security-assessment.md phrasing.
• Confirmation-tag golden provenance: draft-21 Appendix B.3 publishes no confirmation-tag vectors; the testdata/draft21-ristretto255-confirmation-tags.json goldens are package-generated at the primitive seam and compatibility is construction-verified against §10.4. State this in docs/spec-matrix.md so the draft21- filename prefix does not imply draft-published values.