Re-pin to macula-go v0.29.0, the release that carries A0 #17

Purpose (reliability): a PHP application built on this SDK recovers from a sealed_required refusal by resealing to the key the refusal carries, instead of failing for 5 to 10 minutes on a stale keyless candidate.

macula-go v0.29.0 (9f84784a773914ccb419eb928f78ff7fe12599e4) is the release that carries release A0's reading side (macula-io/macula-go#43): a caller that a keyed provider refuses sealed_required reads seal.kem_key from the refusal's signed tbs, reseals to it, and is answered; a clear client stream that wrote before the refusal replays its writes in order under the sealed reopen. That repo proves it in CI on the released sha, and the release carries the run as sealed-interop-v0.29.0.log.

This SDK pins macula-go v0.27.0 (f3ecb6a) today, which predates A0, so it cannot inherit any of that.

Scope

• Pin abi/MACULA_GO_REF from v0.27.0 (f3ecb6a) to v0.29.0 / 9f84784a773914ccb419eb928f78ff7fe12599e4.
• Nothing else changes: no API, no docs beyond the pin line and any version string that names it, no version bump of this package, no tag.
• Run the full suite and this repo's sealed interop against the new pin.

Done when

• CI on the exact tip of the re-pin PR is green, with the interop passing in both profiles.
• The pin line names both the tag and the commit, as it does today.

Refs macula-io/macula-go#43.