[playbook-phase-17] Security, supply chain, and long-term maintainability

[githubrobbi]

Playbook section: docs/dev/architecture/code_clean/world_class_rust_workspace_refactor_playbook.md § Phase 17.

Baseline anchor: Phase-0 final report docs/dev/baseline/2026-05-12/phase_0_final_report.md (local-only per .gitignore:135). Workspace commit at baseline: 710ca6044 (cast-cleanup, PR #186).

Goals (from playbook)

Verify only — already mature. cargo deny ✅ · cargo vet ✅ (134 full + 4 partial + 375 exempted) · cargo audit ✅ (0 vulns, 1 documented bincode 2.0.1 allowance) · CodeQL · dependabot.

Current state (from Phase-0 baseline § 7 entry-point map)

Estimated cost: (verification)

Recommended entry points: (none — already at maintenance grade)

Acceptance criteria

• Read playbook § Phase 17 Check / Refactor / Validate subsections
• Open a tracking branch (refactor/phase-17-...) and a draft PR
• Land work in surgical commits — preserve behavior and contracts (workspace rules: no suppression hacks, no relaxing tests, signed commits)
• Update tests where the refactor changes invariants
• Re-run just baseline-snapshot after merge and compare deltas against docs/dev/baseline/2026-05-12/
• Close this issue with a one-line summary of the LOC / API / risk-marker delta

Workspace policy reminders

1. No suppression hacks (#[allow] blankets, disabled lints, commented-out tests, cfg(any()) hiding)
2. Surgical correct fixes (root cause, not workaround)
3. Preserve behavior & contracts (public API stable unless CI proves it wrong)
4. Improve tests, do not dodge them