Cut 0.2.3/dns-resolver 0.3.1/invoice 0.34.1/types 0.3.2

[TheBlueMatt]

Based on #4722

[ldk-reviews-bot]

I've assigned @jkczyz as a reviewer!
I'll wait for their review and will help manage the review process.
Once they submit their review, I'll check if a second reviewer would be helpful.

[ldk-claude-review-bot]

No issues found.

I reviewed every file and hunk in this 0.2.3 security-release PR:

• Version bumps (Cargo.toml × several) and CHANGELOG.md — trivial, correct.
• lightning-invoice/src/lib.rs — recover_payee_pub_key now delegates to get_payee_pub_key, preferring the explicit payee key. The remaining expect is safe because the constructor's check_signature requires successful recovery when no explicit key is present.
• lightning-rapid-gossip-sync/src/processing.rs — node/channel count caps are sound; the read lock is dropped before write operations (no deadlock); all per-announcement reads occur before the continue skip (no stream desync); arithmetic is u64-safe.
• lightning/src/routing/router.rs — overflow now returns Err(idx+1), which is always in bounds (aggregation overflow requires ≥2 following hops); mark_candidate_liquidity_exhausted prevents re-selection loops.
• lightning/src/onion_message/dns_resolution.rs — switching to byte-slice comparison correctly fixes the UTF-8 boundary panic for unicode-prefixed TXT records.
• lightning/src/util/ser.rs — map pre-allocation cap is correct; cmp is imported; entry_size + 1 avoids div-by-zero for ZSTs.
• lightning/src/util/macro_logger.rs — DebugMsg truncates on a valid char boundary via char_indices().nth(); log_msg! is in scope crate-wide; &String/&Cow<str> deref-coerce to &str.
• lightning/src/ln/{channel,peer_handler}.rs — log_msg! call sites are type-correct.
• possiblyrandom/src/lib.rs — zero-fill-then-getrandom is correct across all cfg combinations.

All changes are consistent, the panic/overflow/DoS fixes are correct, and no new bugs or regressions were introduced.