Implement kaysentinel-hash (domain-separated BLAKE3 commitments, RC1 spec); update README and roadmap to reflect real progress

a74f5ab