Prepare 0.9.6-SNAPSHOT with DH input validation and distinct signer checks

RELEASE-0.9.6-SNAPSHOT.md

@@ -0,0 +1,15 @@
+# crypto2 0.9.6-SNAPSHOT
+
+SafeKeyExchange now rejects peer public keys whose encoded length is not exactly
+32 bytes before calling native bindings. Low-order DH rejection remains delegated
+to libsodium crypto_kx; its failure already propagates through the Kotlin bindings.
+Regression tests cover low-order inputs (including nonzero inputs and high-bit
+aliases), malformed lengths, and valid bidirectional exchange.
+
+This snapshot retains the distinct-signer threshold fix described in
+[SECURITY-0.9.5.md](SECURITY-0.9.5.md). Wire formats are unchanged.
+
+Validation: all 67 JVM tests and all 67 Linux x64 Native tests passed. The three
+focused JavaScript/Node tests fail during initialization with the previously
+documented `_sodium_init is not a function` loader error, before exercising DH.
+Other platform runtimes were not qualified. This snapshot does not fix the JS loader.