Ariadne c5efae43: tlds.bch-driven install + BNS_POLICY, doc-aligned

Three doc-alignment changes shipping in AriadneResolver-Setup-0.1.0.exe
sha256 c5efae43af6cc163f468f1dc73d08939db32a9a6db52298ba18b2d9a2aee1292:

1. install.ps1 fetches the activated TLD list from the on-chain root
   TLD certificate (tlds.bch, per START-HERE §1) via
   resolver-web.js fetchBcnrTlds(), then:
   - regenerates the CA's nameConstraints extension from that list
     (rotates the CA when the on-chain set changes so leaves for the
     newly-activated TLDs actually validate)
   - adds one NRPT rule per activated TLD in surgical mode
   - falls back to bootstrap ["bch"] if the chain is unreachable
   Result: adding a TLD on-chain is picked up by re-running the
   installer, no code release needed.

2. bnsd.js honors --policy / BNS_POLICY (bcnr-first | icann-first,
   alias bns-first) per START-HERE §4b. bcnr-first is default and
   preserves prior behavior. icann-first forwards to upstream first
   and only substitutes a BCNR answer on NXDOMAIN. install.ps1
   accepts -Policy and passes it into the scheduled task action.

3. ca.js loadOrCreateRootCA() now accepts a runtime TLD list; the
   old callers still work (fall back to PERMITTED_TLDS from tlds.js).

Doc: RESOLVER-PACKAGING-PROMPT.md rewritten to reflect current
shipping reality; original 2026-07-26 packaging brief preserved
in the "Archival" section.

Deployed to dl.silentmode.st (nginx serves from /opt/silent-mode/dl/)
and mirrored to Sia bns/silentmode/. VPS bns-indexer.service reports
tlds.bch currently activates: bch p2p deviant nav sia dgb nt sm lm.

releases-manifest.json

@@ -14,7 +14,7 @@
       "signed": false,
       "signingAuthority": null,
       "files": {
-        "AriadneResolver-Setup-0.1.0.exe": "3438d55871d1f7454df691767e6f4be61c6d3ac900606b86f369cc7da8741302"
+        "AriadneResolver-Setup-0.1.0.exe": "c5efae43af6cc163f468f1dc73d08939db32a9a6db52298ba18b2d9a2aee1292"
       }
     },
     {

releases/index.html

@@ -66,7 +66,7 @@
 
     <div class="file">
       <div class="n"><a href="https://dl.silentmode.st/AriadneResolver-Setup-0.1.0.exe">AriadneResolver-Setup-0.1.0.exe</a> — ~24 MB</div>
-      <code>3438d55871d1f7454df691767e6f4be61c6d3ac900606b86f369cc7da8741302</code>
+      <code>c5efae43af6cc163f468f1dc73d08939db32a9a6db52298ba18b2d9a2aee1292</code>
     </div>
   </div>
 

tools/index.html

@@ -129,7 +129,7 @@
     </div>
     <div class="hashes">
       <div style="color:var(--mut);font-size:12.5px">SHA-256 — verify before elevating:</div>
-      <div class="h"><b>Installer</b><code>3438d55871d1f7454df691767e6f4be61c6d3ac900606b86f369cc7da8741302</code></div>
+      <div class="h"><b>Installer</b><code>c5efae43af6cc163f468f1dc73d08939db32a9a6db52298ba18b2d9a2aee1292</code></div>
     </div>
   </div>
 </section>