fix: v0.4.0 — RELAY ecosystem audit fixes

[SoundMatt]

Summary

Fixes all 8 open issues filed by the RELAY ecosystem audit (2026-07-27).

Issues fixed

Spec-conformance:

• [P1] CLI reports stale version "0.1.0" three releases behind the actual v0.3.0 tag #4 — CLI reported a stale version ("0.1.0") three releases behind the actual tag. version/capabilities/status now report PROJECT_VERSION via a generated header (cli/version.hpp.in) instead of a second hard-coded literal, and CMakeLists.txt's project(... VERSION ...) is bumped to 0.4.0 for this release. Also fixes the same stale-0.1.0 pattern in .fusa.json and the two cpfusa init --project-version invocations in ci.yml (which run --force, so they'd have silently overwritten .fusa.json back to 0.1.0 on every CI run).
• [P1] capabilities document lists the protocol name ("LIN") as a transport instead of an actual transport backend #5 — capabilities listed the protocol name ("LIN") as a transport instead of an actual transport backend. Now reports "transports":["virtual"].
• [P1] convert writes a non-existent sentinel name ("ErrInvalidInput") to stderr instead of "ErrInvalidFrame" #7 — convert wrote the nonexistent sentinel name ErrInvalidInput to stderr instead of ErrInvalidFrame (the actually-thrown type). Fixed to match spec §11.2/§5.
• [P2] "tool" field in version/capabilities/status documents uses mixed-case "cpp-LIN" instead of the lowercase binary-name convention #9 — "tool" field used mixed-case "cpp-LIN" instead of the lowercase CLI-binary-name convention (cpp-lin, matching go-can/cpp-rcp).
• [P2] No module literally named mock per spec section 13.7.1's canonical module-name registry #10 — No module literally named mock per spec §13.7.1. Added lin::mock (include/lin/mock/mock.hpp) aliasing the existing lin::virt::Bus, plus "mock" in the capabilities features list.
• [P2] version/status CLI commands silently ignore the --format flag; no invalid-args handling #11 — version/status silently ignored --format and never validated arguments. Both now support --format text|json, with a human-readable text rendering, and exit 2 on an unrecognized format value or any other unrecognized argument.

Bug fixes:

• [P1] Adapt() subscription thread captures raw this pointer; adapter destruction while the thread runs is a use-after-free #8 — Adapt()'s subscription thread captured the adapter's this by raw pointer and dereferenced it (++seq_) for the thread's lifetime; nothing joined the detached thread on adapter destruction, so dropping the adapter (while the bus stayed open) was a use-after-free on the next inbound frame. Fixed by moving the seq counter into a shared_ptr<atomic<uint64_t>> captured into the thread instead of this — the thread now never touches the adapter, and as a side effect this also brings seq-counter ownership in line with spec §10.5.2 point 7 (owned per-subscription, not shared across Adapt() calls).
• [P1] Out-of-range LIN frame ID is signalled as ErrPayloadTooLarge instead of ErrInvalidFrame (spec section 5.3) #6 — Out-of-range LIN frame ID was signalled as ErrPayloadTooLarge instead of a structural-violation error, at 5 call sites (spec §5.3: "ErrInvalidFrame and ErrPayloadTooLarge are distinct ... ValidateFrame MUST NOT return ErrPayloadTooLarge"). Added lin::Errc::invalid_frame (a LIN-specific std::error_category, not mapped to any relay::Errc, matching the CAN ErrInvalidFrame pattern in spec §5.4) and applied it to virtual::Bus::do_publish()/send_header(), master::Node::set_schedule()/run(), and — found during the fix, same mis-mapping, not in the original issue evidence — slave::Node::set_response(). LinAdapter::send() (the relay::INode interface, constrained to the four documented relay sentinels per §10.1) now delegates to the existing from_message() instead of duplicating ID-parsing logic, but still approximates with ErrPayloadTooLarge as the issue itself notes is unavoidable there.

Docs

• ROADMAP.md was rewritten to reflect what v0.1.0–v0.3.0 actually shipped (it still described unshipped v0.2.0/v0.3.0 plans — "Enhanced Bus Features"/"Diagnostics" — for content that in reality shipped as the Full Safety & Cyber Pack and RELAY v1.11 conformance releases). Future unshipped plans renumbered to start at v0.5.0 so they don't collide with real tags again.
• README.md architecture section and features list updated for the new mock module.

Issues closed as already-resolved

None — all 8 open issues were live gaps in the current code, verified against the actual current source before fixing.

Issues left open

None.

Test plan

• cmake -B build -DCMAKE_BUILD_TYPE=Release -DRELAY_BUILD_CLI=ON -G Ninja && cmake --build build --parallel — clean build
• ctest --test-dir build -j1 — 171/171 tests pass (added tests/test_mock.cpp, plus new cases in test_lin.cpp/test_cli.cpp for the sentinel and --format fixes)
• Rebuilt with -Werror under -Wall -Wextra -Wpedantic -Wshadow ... (this repo's own flag set) — clean, no warnings
• Manually exercised version/version --format text/version --format bogus/status/status --format text/capabilities/convert (invalid frame) against the built CLI binary to confirm exit codes and output match the fixes