SEA capability additions — PRs #1424, #1425, #1426 (please approve workflow runs)

[ABsUP]

SEA capability additions — PRs #1424, #1425, #1426 (please approve workflow runs)

Hello! This issue is to introduce three small, tested SEA additions I've opened as PRs from my fork (OpenCodeWEB/Gun), and to ask maintainers to approve the GitHub Actions workflow runs — the PR merge boxes are currently blocked on "1 workflow awaiting approval from a maintainer" (first-time fork contributor gate).

The PRs

1. feat(sea): add SEA.share/SEA.unshare - zero-knowledge multi-user encryption #1424 — SEA.share / SEA.unshare: zero-knowledge multi-recipient encryption. One capsule, N recipients; session key wrapped per-recipient via existing ECDH (SEA.secret). Non-recipients cannot decrypt; tamper-evident via AES-GCM. 7 tests. Suite: 42 passing / 1 pending / 0 failing.
2. feat(sea): add SEA.timelock - time-locked encryption & dead-man's switch #1425 — SEA.timelock: hash-chain time-locked encryption (sequential SHA-256 chain, rounds-deep) with an optional signed dead-man's switch payload, anti-DoS max guard on unlock. 8 tests. Suite: 43 passing / 1 pending / 0 failing.
3. feat(sea): add SEA.role - signed RBAC role tokens #1426 — SEA.role: signed RBAC role tokens (grant / verify / has) issued by an admin, verifiable anywhere with only the admin public key, with expiry support. Composes with SEA.certify and the roles-node pattern. 8 tests. Suite: 43 passing / 1 pending / 0 failing.

All three follow existing SEA conventions (promise + callback styles, S.parse/S.stringify safe, no new dependencies), are fully additive, and ship with their tests in test/sea/sea.js. The bundles (sea.js) were regenerated with npm run unbuildSea so sea/ stays canonical.

Ask

• Approve the workflow runs on the three PRs so CI can execute the SEA test suite (approving once clears the first-time-contributor gate).
• Review when convenient — happy to adjust anything (naming, semantics, API shape).

(Also noteworthy: sea/index.js in #1424 syncs the extracted module with the bundle — the certificant membership check data.c.indexOf('*' || certificant) always evaluated to '*'; the bundle already had the fix, the extracted file was stale.)