Summary

Drains the remaining 21 open code-scanning alerts (12 OSV + 9 CodeQL) left after the security-hardening (#316) pass. After merge, code-scanning should go to 0 open. OSV-scanner CI run should turn green (was failing on every push to dev because of these).

OSV-scanner (12 alerts -> 0)

• idna CVE-2026-45409 (2x medium, real CVE): patched in idna >= 3.15. Pinned idna>=3.15 as a direct floor in docs/requirements.txt and python/quantum-pecos/docs/requirements.txt (it was transitive via mkdocs/sphinx deps).
• 10 transitive Rust RUSTSEC warnings: all pulled by upstream crates we cannot fix from this repo (hugr-passes/hugr/tket, fusion-blossom, mwpf -> slp -> structopt -> clap2). Added osv-scanner.toml at workspace root + scripts/native_bench/bench_pecos/osv-scanner.toml with per-CVE [[IgnoredVulns]] entries -- each records the dependency chain and upstream owner of the fix, not blanket suppressions. Review when bumping hugr/tket, fusion-blossom, or mwpf.

CodeQL rust/access-invalid-pointer (9 alerts -> 0)

Audited every site -- 0 real bugs:

• 5 of 9 are inside #[cfg(test)] mod tests where the deref is preceded by assert!(!ptr.is_null()). Added one-line // SAFETY: comments at each deref.
• 2 of 9 are vtable derefs in pecos-foreign/src/discovery.rs inside if !is_null() branches. Added // SAFETY: comments citing the null-check + plugin protocol.
• 2 of 9 are FFI entries in pecos-foreign/src/engine.rs (pecos_engine_process, pecos_engine_reset). Added // SAFETY: comments AND an if engine.is_null() { return -1; } defensive null-check at each FFI entry. This matches the existing pecos_engine_free / pecos_free_outcomes defensive pattern (closes an existing Chesterton's-fence asymmetry where some FFI entries null-checked and others trusted). Added a #[cfg(test)] module covering the new null-return behaviour (pecos-foreign previously had 0 unit tests).

Test plan

• just lint clean
• cargo test -p pecos-qis-ffi --lib (89 pass, 0 fail)
• cargo test -p pecos-foreign --lib (2 pass, 0 fail -- the two new null-return tests)
• CI: confirm OSV-scanner run goes green
• CI: confirm code-scanning total at 0 open after next scan