fix(security): patch lz4_flex and rustls-webpki CVEs, document lru unmitigability

Bump lz4_flex 0.11.5 → 0.11.6 (RUSTSEC-2026-0041, CVSS 8.2 HIGH):
  Memory leak from uninitialised buffers on malicious LZ4 decompression.
  Transitive via tantivy 0.25.0. Semver-compatible bump.

Bump rustls-webpki 0.103.9 → 0.103.10 (RUSTSEC-2026-0049):
  CRL Distribution Point matching logic error.

Document lru 0.12.5 (RUSTSEC-2026-0002) as UNMITIGABLE:
  Fix is in 0.16.3, semver-incompatible with tantivy's ^0.12 pin.
  Theoretical soundness issue (Stacked Borrows), not exploitable.
  verisim-document uses #![forbid(unsafe_code)].
  Accepted risk until tantivy 0.26.

Concatenative danger (lz4_flex × lru) is now broken:
  lz4_flex was the exploitable half. With it fixed, the lru
  unsoundness alone cannot leak data through the document pipeline.

cargo audit: 0 vulnerabilities (was 2), 4 warnings remaining.

Identified by manual Patch Bridge assessment.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

Cargo.toml

@@ -125,11 +125,24 @@ lto = true
 codegen-units = 1
 panic = "abort"
 
-# NOTE: lru 0.12.5 has RUSTSEC-2026-0002 (IterMut Stacked Borrows, LOW severity)
-# Transitive dependency of tantivy 0.25.0 and ratatui 0.29.0
-# Waiting for upstream fix. Not directly patchable without forking dependencies.
-
+# Patch Bridge mitigations — forced upgrades for transitive CVEs in tantivy 0.25.0
+# These override the versions pinned by tantivy without forking.
+#
+# RUSTSEC-2026-0041: lz4_flex 0.11.5 — memory leak on decompression (CVSS 8.2 HIGH)
+#   Chain: tantivy 0.25.0 → lz4_flex 0.11.5
+#   Fix: 0.11.6 adds proper offset validation. Semver-compatible, safe to patch.
+#
+# RUSTSEC-2026-0002: lru 0.12.5 — IterMut Stacked Borrows violation (unsound)
+#   Chain: tantivy 0.25.0 → lru 0.12.5
+#   Fix: 0.12.6+ not available in 0.12.x line. Patching to 0.12.5 is NOT possible.
+#   The fix is in 0.16.3 which is semver-incompatible with tantivy's lru ^0.12 pin.
+#   Status: UNMITIGABLE without tantivy upgrade. tantivy 0.25.0 is latest.
+#   Risk: Low in practice — VeriSimDB uses #![forbid(unsafe_code)] in verisim-document,
+#   and the IterMut violation requires specific Miri-detectable UB, not exploitable
+#   in normal execution. Accepted risk until tantivy 0.26.
+#
 # NOTE: quinn-proto 0.11.14 (Dependabot alert — build-time only, NOT runtime)
 # Chain: burn 0.20 → cubecl-cpu → tracel-llvm-bundler (build dep) → reqwest 0.12 → quinn → quinn-proto
 # This is a build-time dependency for LLVM artifact download, not in any production code path.
 # Waiting for burn 0.21 stable release. reqwest bumped to 0.13 for direct deps.
+