- reject reserved HashId values across lookup/parse/encode paths
- add reserved-range registry table and remove 0x0000 from runtime list
- forbid SHA-256 impl overrides; add streaming hash API
- update tgk_store_mem test to use unsupported but non-reserved hash id
- document ASL store digest-length constraint in README