Pin the Julia supply chain and model the real trust boundaries (#35)

- Commit Manifest.toml (generated under Julia 1.10, same minor as e2e
CI) and stop ignoring it in .gitignore: the Julia layer computes every
number the product returns, so its transitive dependency graph is now
pinned by tree hash. CI's Pkg.instantiate/Pkg.test resolve from the
committed manifest by default — no workflow change needed.
- dependabot.yml: remove cargo/mix/npm/pip/nix entries — none of those
ecosystems exist in this Julia/Zig/Agda repo. Dependabot has no Julia
ecosystem; the committed Manifest + CI instantiate is the compensating
control. github-actions coverage kept.
- docs/THREAT-MODEL.md: add an Application-Specific Boundaries section
modelling the neural->symbolic boundary (LLM numeric fabrication, prompt
injection via user data, tool mis-routing, silent-null sub-types) and
the Zig FFI/C-ABI boundary (unvalidated inputs, memory safety, ABI
drift). Fix false claims: the Cargo.lock/deno.lock/gleam.toml asset row,
the nonexistent scorecard-enforcer.yml, and the "lockfiles committed"
mitigation (now true only for Manifest.toml).

PR 5 of 8 in the severity-ordered chain (fix/supply-chain-pinning).

<!--
SPDX-License-Identifier: CC-BY-SA-4.0
Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
-->
## Summary

<!-- Briefly describe what this PR does and why. Link to related issues
with "Closes #N". -->

## Changes

<!-- List the key changes introduced by this PR. -->

-

## RSR Quality Checklist

<!-- Check all that apply. PRs that fail required checks will not be
merged. -->

### Required

- [ ] Tests pass (`just test` or equivalent)
- [ ] Code is formatted (`just fmt` or equivalent)
- [ ] Linter is clean (no new warnings or errors)
- [ ] No banned language patterns (no TypeScript, no npm/bun, no
Go/Python)
- [ ] No `unsafe` blocks without `// SAFETY:` comments
- [ ] No banned functions (`believe_me`, `unsafeCoerce`, `Obj.magic`,
`Admitted`, `sorry`)
- [ ] SPDX license headers present on all new/modified source files
- [ ] No secrets, credentials, or `.env` files included

### As Applicable

- [ ] `.machine_readable/STATE.a2ml` updated (if project state changed)
- [ ] `.machine_readable/ECOSYSTEM.a2ml` updated (if integrations
changed)
- [ ] `.machine_readable/META.a2ml` updated (if architectural decisions
changed)
- [ ] Documentation updated for user-facing changes
- [ ] `TOPOLOGY.md` updated (if architecture changed)
- [ ] `CHANGELOG` or release notes updated
- [ ] New dependencies reviewed for license compatibility (MPL-2.0 /
MPL-2.0)
- [ ] ABI/FFI changes validated (`src/abi/` and `ffi/zig/` consistent)

## Testing

<!-- Describe how you tested these changes. -->

## Screenshots

<!-- If applicable, add screenshots or terminal output demonstrating the
change. -->

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/dependabot.yml

@@ -1,6 +1,10 @@
 # SPDX-License-Identifier: MPL-2.0
-# Dependabot configuration for RSR-compliant repositories
-# Covers common ecosystems - remove unused ones for your project
+# Dependabot configuration for Statistikles.
+#
+# Only ecosystems that actually exist in this repo are listed. Dependabot has
+# NO Julia ecosystem, so the Julia dependencies (the compute half) are covered
+# by a committed Manifest.toml + CI `Pkg.instantiate`/`Pkg.test`, which resolve
+# from the pinned manifest, instead. See docs/THREAT-MODEL.md.
 
 version: 2
 updates:
@@ -13,39 +17,3 @@ updates:
       actions:
         patterns:
           - "*"
-
-  # Rust/Cargo
-  - package-ecosystem: "cargo"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    # `open-pull-requests-limit: 0` suppresses routine version-update PRs
-    # while leaving Dependabot SECURITY PRs flowing. The previous
-    # `ignore: "*" patch` rule also silenced security PRs under GitHub\'s
-    # current Dependabot behaviour. See rsr-template-repo commit 78b050e
-    # and 007-lang/audits/audit-dependabot-automation-gap-2026-04-17.md.
-    open-pull-requests-limit: 0
-
-  # Elixir/Mix
-  - package-ecosystem: "mix"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-
-  # Node.js/npm
-  - package-ecosystem: "npm"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-
-  # Python/pip
-  - package-ecosystem: "pip"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-
-  # Nix flakes
-  - package-ecosystem: "nix"
-    directory: "/"
-    schedule:
-      interval: "weekly"

.gitignore

@@ -36,7 +36,9 @@ erl_crash.dump
 # Julia
 *.jl.cov
 *.jl.mem
-/Manifest.toml
+# Manifest.toml is COMMITTED here (supply-chain pinning of the compute half;
+# Dependabot has no Julia ecosystem, so the committed manifest + CI
+# Pkg.instantiate is the compensating control). Do not re-ignore it.
 
 # ReScript
 /lib/bs/