fee/vectors: fix stale pin docs after master re-pin (FIL-473)

The reference pin moved to a commit reachable from master once upstream
PR #2 merged, but three doc spots still described the pre-merge state and
contradicted the script: they claimed master seals tag-96 bodies under
the buggy "Encrypt0" context and told the reader to re-pin later, and the
regeneration section still named refs/pull/2/head.

Describe the pin as what it is — a fixed commit on master carrying the
merged RFC 9052 5.3 fix — and keep the caveat where it belongs: commits
before that fix are not comparable with these vectors.

Signed-off-by: Miroslav Bajtoš <oss@bajtos.net>
Assisted-by: Claude:claude-opus-5

Author: bajtos

fee/vectors/README.md

@@ -7,11 +7,11 @@ across two implementations:
 - **TypeScript** — the reference `foc-encryption`
   ([`Kubuxu/foc-encryption-demo`](https://github.com/Kubuxu/foc-encryption-demo),
   `packages/foc-encryption`), **pinned** in
-  [`pull-foc-encryption.sh`](./pull-foc-encryption.sh) to the head of
-  [PR #2](https://github.com/Kubuxu/foc-encryption-demo/pull/2)
-  (`158571ae…`) — the RFC 9052 §5.3 fix. Master is deliberately *not* used: it
-  still seals tag-96 bodies under the buggy `"Encrypt0"` context. Re-pin to the
-  merge commit once the PR lands.
+  [`pull-foc-encryption.sh`](./pull-foc-encryption.sh) to `158571ae…` on
+  `master` — the RFC 9052 §5.3 fix, which landed upstream in
+  [PR #2](https://github.com/Kubuxu/foc-encryption-demo/pull/2). Before that fix
+  the reference sealed tag-96 bodies under the wrong `"Encrypt0"` context, so
+  vectors are only comparable against this commit or later.
 
 The reference is the **source of truth** for the wire format; these vectors pin
 to it and this repo's `fee/*` matches it (see [Wire format](#wire-format)).
@@ -77,7 +77,7 @@ FEE_VECTORS_REGEN=1 GOWORK=off go test ./fee/vectors -run TestGenerate -v
 ```
 
 `pull-foc-encryption.sh` vendors the pinned reference into `ts/vendor/`
-(gitignored — never committed): `git clone` + `git fetch refs/pull/2/head`,
+(gitignored — never committed): `git clone` + `git fetch refs/heads/master`,
 checking out the pinned SHA, and falling back to fetching the pinned source files
 from `raw.githubusercontent.com` where `git` is unavailable. It requires
 [`bun`](https://bun.sh) to run the TypeScript.

fee/vectors/doc.go

@@ -6,10 +6,11 @@
 // foc-encryption), pinned in pull-foc-encryption.sh.
 //
 // The reference is the source of truth for the wire format. It is pinned (see
-// pull-foc-encryption.sh) to the head of foc-encryption-demo PR #2 — the fix
-// that makes the body AAD context follow the envelope structure per RFC 9052
-// §5.3 — rather than master, which still seals tag-96 bodies under "Encrypt0".
-// The shape, verified against the pinned commit, is:
+// pull-foc-encryption.sh) to a fixed commit on foc-encryption-demo master — the
+// merged fix (upstream PR #2) that makes the body AAD context follow the
+// envelope structure per RFC 9052 §5.3. Commits before that fix seal tag-96
+// bodies under "Encrypt0" and are not comparable with these vectors. The shape,
+// verified against the pinned commit, is:
 //
 //	blob        = envelope || ciphertext          (detached payload)
 //	envelope    = 16([protected, unprotected, null])                for no recipients