FIX zerogpu NVML crash: defer cuda placement into the GPU context (no startup CUDA init); reject failed wishes honestly instead of empty-granting

security: re-moderate model text, identity-bound rite token, XFF/queue-freeze hardening, OOM guard; README truth fixes

browser-handshake unit tests