chore(health): clear RUSTSEC-2026-0190 (anyhow bump) + refresh stale verify README (#196)

Two remediations from the 2026-07-07 health check:

1. **Cargo Audit CI red**: RUSTSEC-2026-0190 (unsoundness in
`anyhow::Error::downcast_mut`) — `cargo update -p anyhow` 1.0.102 →
1.0.103. Full workspace test suite green after the bump (152 tests).
2. **Stale status checklist**: `crates/typed-wasm-verify/README.md`
still showed C2–C5 unchecked; all four are implemented (`section.rs`,
`verify.rs` incl. L13 negative-form isolation, `cross.rs`, and both
cross-compat suites with real AffineScript fixtures). Checklist now
matches the code and points at the genuinely-open work (#140
positive-form region-imports, unstable L2/L15 carriers).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: hyperpolymath

Cargo.lock

@@ -1,4 +1,5 @@
 <!-- SPDX-License-Identifier: CC-BY-SA-4.0 -->
+<!-- Copyright (c) 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk> -->
 # typed-wasm-verify
 
 Post-codegen verifier for typed-wasm **L7 (aliasing safety)** and **L10 (linearity)** constraints on emitted wasm modules.
@@ -38,7 +39,9 @@ The OCaml files remain the spec of record until behavioural parity is establishe
 ## Status
 
 - [x] C1 — Scaffold (types, error enums, public entry stubs)
-- [ ] C2 — Custom-section parser
-- [ ] C3 — Per-path use-range analysis (L7+L10 intra-function)
-- [ ] C4 — Cross-module boundary verifier
-- [ ] C5 — Cross-compat test against affinescript-emitted wasm
+- [x] C2 — Custom-section parser (`src/section.rs`)
+- [x] C3 — Per-path use-range analysis (L7+L10 intra-function, `src/verify.rs`; includes L13 negative-form module isolation)
+- [x] C4 — Cross-module boundary verifier (`src/cross.rs`)
+- [x] C5 — Cross-compat test against affinescript-emitted wasm (`tests/cross_compat.rs` synthetic parity table + `tests/cross_compat_real.rs` real fixtures under `tests/fixtures/c5_real/`)
+
+Still open: L13 positive-form region-imports agreement (typed-wasm#140, proposal 0003) and carrier-backed L2–L6/L15 passes graduating from the `unstable-l2`/`unstable-l15` features.