- Remove ALIGN(64) from blake2 structs inside #pragma pack(1)
- Move parallel state structs outside pack block
- Fix blake2s array-of-1 alignment issue
- Use boost::placeholders instead of std::placeholders with boost::bind
- Add Dockerfile for reproducible builds with BDB 4.8 from source

Fixes #137

GCC 13 and later have optimization bugs that cause undefined behavior
in the BMW256 hash function when compiled with -O2 or higher. This
results in incorrect LYRA2REv2 hashes and causes block verification
failures at Fork #1 (block 450,947) and beyond.

The fix adds explicit build rules for LYRA2RE-related source files
(bmw.c, Lyra2RE.c, Lyra2.c, Sponge.c) to compile them with -O1
optimization level instead of the default.

Fixes #141

- Add $(CFLAGS) to compilation rules so user-specified flags are applied
- Place $(LYRA2RE_CFLAGS) last to ensure -O1 overrides any optimization flags
- Improve comment wording: "optimizer bug" is more accurate than "undefined behavior"

OpenSSL 3.x has stricter DER signature parsing than OpenSSL 1.x,
causing signature verification to fail at block 605,359 and potentially
other blocks with non-canonical signature encodings.

Add ecdsa_sig_parse_der_lax() as a fallback parser when OpenSSL's
strict d2i_ECDSA_SIG() fails. The lax parser:

- Manually parses DER SEQUENCE and INTEGER tags
- Extracts R and S values using BN_bin2bn()
- Creates ECDSA_SIG using ECDSA_SIG_set0()

Also adds ECDSA_SIG_set0() compatibility shim for OpenSSL < 1.1.0.

Fixes #145

Pins a reproducible build of the existing consensus/build fixes (#138,
#142, #146) to Ubuntu 24.04 LTS, whose settled GCC 13 / Boost 1.83
toolchain avoids the modern-toolchain miscompiles that have changed
Bitmark's consensus results (GCC-13 BMW256/LYRA2REv2 at block 450,947;
OpenSSL 3.x DER at block 605,359).

The binary built this way was validated by a full chain reindex,
genesis -> tip (height 2,399,930), with zero errors; the reindexed tip
hash and both fork-block hashes match the live network.

- Dockerfile.build: pin ubuntu:24.04, BDB 4.8 --with-mutex=POSIX/pthreads,
  ca-certificates
- build-docker.sh: one-command containerised build + binary extraction
- .dockerignore: keep the build context to daemon source only
- BUILD.md: build instructions, the do-not-use-aggressive-flags warning,
  validation summary, and known follow-up (parser hardening, PoW
  self-test, checkpoints-disabled sig validation, static binary)
- README.md: pointer to BUILD.md
- .gitignore: keep built binaries and the BDB source tree out of git