[crypt0rr]

Summary

• Add fail-closed potfile validation before normal Hashcat execution.
• Reject missing, non-regular, unreadable, and unwritable potfiles without creating or mutating them.
• Preserve non-mutating dry-run behavior for a missing potfile.
• Add focused validation coverage and update the README, version notes, and backlog.

Why

Normal startup previously attempted to create a missing potfile and continued even when creation failed. That allowed an invalid runtime configuration to reach later session or processor logic. The new startup gate reports the exact potfile problem and stops before Hashcat starts.

Validation

• make test-smoke
• make test-campaign
• make lint
• Bash coverage: 100.00% executable-line and function coverage; baseline satisfied

All tests use isolated fixtures and fake dependencies; no GPU, real Hashcat execution, network access, or developer-local configuration is required.