v0.3: 6-layer architecture complete

Layers:
  Layer 1: XDP/eBPF — TCP state machine, SYN throttle, blacklist, ringbuf
  Layer 2: PoW Challenge — SHA-256 hashcash, dynamic difficulty, constant-time verify
  Layer 3: Rust Core — HMAC handshake, rate limit, death code (existing)
  Layer 4: Velocity — Physics check, CAPTCHA, protocol verification
  Layer 5: Paper — Heartbeat, auto-registration (existing)
  Layer 6: Traffic Intel — EWMA, 168h profiling, reputation, alerts

Infra: XDP→Prometheus metrics, ClickHouse + Grafana dashboard, Docker Compose
Testing: 100-IP DDoS simulation, MHDDoS ref analysis, load test report
Fixes: VarInt sign extension UB, pure ACK deadlock, RST/FIN cleanup
Ref: MHDDoS, Sonar, LimboFilter, AtomGuard, Infrarust, MC-XDP-eBPF, PowGo

crates/rampart-core/src/pow/verifier.rs

@@ -0,0 +1,31 @@
+use crate::pow::challenge::Challenge;
+use sha2::{Digest, Sha256};
+use subtle::ConstantTimeEq;
+
+const ALLOWED: [u8; 4] = [b'0', b'1', b'2', b'3'];
+
+pub fn verify(challenge: &mut Challenge, nonce: &str) -> bool {
+    if challenge.used {
+        return false;
+    }
+    if challenge.is_expired() {
+        return false;
+    }
+    if nonce.len() > 64 {
+        return false;
+    }
+
+    let input = format!("{}{}", challenge.challenge_string(), nonce);
+    let hash = Sha256::digest(input.as_bytes());
+    let hex_hash = hex::encode(hash);
+    let d = challenge.difficulty as usize;
+    let ok = hex_hash.as_bytes().iter().take(d).all(|c| {
+        let r = c.ct_eq(&ALLOWED[0]) | c.ct_eq(&ALLOWED[1]) | c.ct_eq(&ALLOWED[2]) | c.ct_eq(&ALLOWED[3]);
+        r.unwrap_u8() == 1
+    });
+    if !ok {
+        return false;
+    }
+    challenge.used = true;
+    true
+}