chore(release): v0.5.43

[musharna]

Ships the 2026-09-02 audit remediation merged in d57daaf, plus the privacy
scrub from #129/#130. Until this release none of it is anywhere but main: the
broker on the fleet still runs 0.5.42, so job list --project still misses
jobs whose spelling was folded at submit, job projects set ../reload 5 still
fires a config reload and then reports a write that never happened, and a
project declared with roots: but no priority: still vanishes from the
table with no log line.

The operator-facing item in this release is the one that needs an action, not
just an upgrade: the tracked config/projects.yaml is now pseudonymised, and
the real roots and names live in a gitignored config/projects.local.yaml
beside it. A deploy that does not carry that file over loses cwd-derived
identity for those roots and silently prices them at _default. See
docs/projects-yaml.md.

Also worth knowing for anyone running more than one job per worker: the
reparented-orphan sweep could kill a concurrently-starting job's child during
another job's cleanup. Only reachable with max_concurrent > 1.

Pure release commit: version bump plus the changelog roll, no source changes.
The bump touches five files (pyproject.toml, server.json x3, CITATION.cff,
uv.lock, CHANGELOG.md) and consumes seven changelog.d fragments.

Gates on this tree: 1342 passed, 9 deselected, coverage 87.06% (floor 83).
ruff check, ruff format and mypy clean. The quickstart dry-run passed all six
steps against the built 0.5.43 wheel in a pristine python:3.11-slim container
with zero JOBD_* variables set.