security(deps): clear cargo-audit vuln + 2 unmaintained-crate warnings (#31)

Resolves:
- RUSTSEC-2026-0104 (reachable panic in rustls-webpki CRL parsing) via
cargo update -p rustls-webpki --precise 0.103.13
- RUSTSEC-2025-0119 (number_prefix unmaintained) by bumping indicatif
0.17 → 0.18 — 0.18 replaces number_prefix with unit-prefix internally;
only ProgressBar / ProgressStyle are used (main.rs:823-832), stable API
- RUSTSEC-2021-0127 (serde_cbor unmaintained) by replacing with ciborium
0.2 in the verisim-gated proof_encoding module; 14/14 proof_encoding
tests pass under --features verisim

Remaining: RUSTSEC-2025-0134 (rustls-pemfile via tonic 0.12) — deferred;
tonic 0.13 is a breaking-API bump and warrants its own branch.

Verified: cargo check --lib, cargo check --bin echidna, cargo check
--features verisim --lib all clean; cargo audit drops from 1 error + 3
warnings to 0 errors + 1 warning.

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

Cargo.lock

@@ -35,7 +35,7 @@ thiserror = "2"
 # CLI
 clap = { version = "4", features = ["derive"] }
 colored = "3"
-indicatif = "0.17"
+indicatif = "0.18"
 
 # Logging
 tracing = "0.1"
@@ -67,7 +67,7 @@ uuid = { version = "1", features = ["v4", "serde"] }
 lazy_static = "1"
 
 # VeriSimDB integration (optional — behind "verisim" feature)
-serde_cbor = { version = "0.11", optional = true }
+ciborium = { version = "0.2", optional = true }
 sha2 = { version = "0.10", optional = true }
 
 # Chrono for timestamps
@@ -86,7 +86,7 @@ typed-wasm = { path = "crates/typed_wasm" }
 default = []
 chapel = []       # Enable Chapel parallel proof search (requires Zig FFI library)
 verisim = [     # Enable VeriSimDB persistent proof storage (8-modality octads)
-    "dep:serde_cbor",
+    "dep:ciborium",
     "dep:sha2",
 ]
 # Enable the live-prover test suite (tests/live_prover_suite.rs). Gated so that

Cargo.toml

@@ -24,12 +24,14 @@ use crate::provers::ProverKind;
 ///   - Self-describing (VeriSimDB can introspect without schema)
 ///   - Matches VeriSimDB's semantic modality expectation
 pub fn encode_proof_state_cbor(proof: &ProofState) -> Result<Vec<u8>> {
-    serde_cbor::to_vec(proof).context("Failed to CBOR-encode ProofState")
+    let mut buf = Vec::new();
+    ciborium::into_writer(proof, &mut buf).context("Failed to CBOR-encode ProofState")?;
+    Ok(buf)
 }
 
 /// Decode a ProofState from CBOR bytes.
 pub fn decode_proof_state_cbor(bytes: &[u8]) -> Result<ProofState> {
-    serde_cbor::from_slice(bytes).context("Failed to CBOR-decode ProofState")
+    ciborium::from_reader(bytes).context("Failed to CBOR-decode ProofState")
 }
 
 /// Generate a stable, content-addressed proof identity for use as a VeriSimDB octad key.