C1 is a conjunction - inscribe requires that the sender (a) currently holds
the Cell ASA AND (b) is the controlling owner recorded at mint - but only (b)
had coverage.

test_flash_custody_rejected builds a holder who is not the owner. Every other
test mints with mint_cell(algorand, admin, admin), so the sender is always
both, and mint_cell's transfer branch is itself dead. The state in which
`assert exists and balance == UInt64(1)` is the DECIDING assert - recorded
owner, no longer holding - was never constructed.

It is not a hypothetical. update_owner is a separate, voluntary call, so a
seller who transfers the Cell ASA on a secondary market stays the recorded
controlling owner until someone calls it. Without (a) that seller can inscribe
the buyer's cell; C2 makes inscription write-once and update_owner is blocked
afterwards, so the buyer's cell is PERMANENTLY consumed with the seller's
artifact. That is the exact inverse of the flash-custody vector the suite does
cover.

The test also asserts WHICH conjunct fired. A bare pytest.raises(Exception) -
the pattern every other negative test here uses - would pass if the rejection
came from (b) or from anything unrelated, leaving (a) untested while looking
covered.

MUTATION PROOF, end to end rather than by inspection:
  - deleted the C1(a) assert from inscription.py
  - recompiled with the pinned puyapy 5.8.1 and regenerated the typed client
  - confirmed the string is gone from the TEAL and the client
  - ran the suite against a LocalNet deployment of the mutated contract

    1 failed, 22 passed
    test_recorded_owner_who_no_longer_holds_is_rejected: DID NOT RAISE

The 22 pre-existing tests stayed green, exactly as predicted, and the failure
mode is the vulnerability itself: the inscribe SUCCEEDED. Restored and
re-verified: 23 passed.

Reproducing this needs LocalNet, a built Falcon library, and the pinned
compile venv; see the PR for the build notes.

Found by an adversarial claim-vs-enforcement sweep (TCE-14).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Bumps [semantic-release](https://github.com/semantic-release/semantic-release) from 23.0.6 to 25.0.9.
- [Release notes](https://github.com/semantic-release/semantic-release/releases)
- [Commits](https://github.com/semantic-release/semantic-release/compare/v23.0.6...v25.0.9)

---
updated-dependencies:
- dependency-name: semantic-release
  dependency-version: 25.0.9
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps [typedoc](https://github.com/TypeStrong/TypeDoc) from 0.25.12 to 0.28.20.
- [Release notes](https://github.com/TypeStrong/TypeDoc/releases)
- [Changelog](https://github.com/TypeStrong/typedoc/blob/master/CHANGELOG.md)
- [Commits](https://github.com/TypeStrong/TypeDoc/compare/v0.25.12...v0.28.20)

---
updated-dependencies:
- dependency-name: typedoc
  dependency-version: 0.28.20
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>