Resolve ZKP/sanctify integration and security dependency updates (#19)

* docs: mark issue #6 ZKP/sanctify as resolved

The KNOWN-ISSUES.adoc entry for issue #6 predated the actual
implementation. zkp.rs (367 LOC), zkp_bridge.rs (628 LOC), and
sanctify_bridge.rs (413 LOC) are in place, wired through the VQL
type checker and executor as first-class proof types.

https://claude.ai/code/session_01GeiWCLLoZmPdnjMMcy2buu

* deps: bump burn 0.20 → 0.21, uuid 1.11 → 1.23

Resolves RUSTSEC-2026-0097 (rand 0.10.0 unsoundness): burn 0.21 brings a
transitive rand bump to 0.10.1, the patched version. uuid 1.23.1 follows
naturally. Cargo audit drops from 7 → 6 advisories; the remaining 6 are
all transitive within the burn ML stack (bincode, core2, paste,
rustls-pemfile, lru) and require upstream fixes. Workspace builds clean;
verisim-tensor tests still pass.

https://claude.ai/code/session_01GeiWCLLoZmPdnjMMcy2buu

* deps(elixir): pin patched bandit/plug/postgrex for 3 high-severity CVEs

Addresses three GHSA advisories matching mix.lock entries:

- bandit ≥ 1.11.1 — GHSA-rf5q-vwxw-gmrf (chunked-trailer DoS, High,
  CVSS 8.7). Affected: 1.6.0 ≤ x < 1.11.1; we were on 1.10.3.

- plug ≥ 1.19.2 — GHSA-468c-vq7p-gh64 (multipart-header buffer
  exhaustion, High, CVSS 8.2). Affected: 1.19.0 ≤ x < 1.19.2; we were
  on 1.19.1. Pinned directly even though plug is transitive via
  bandit, so the constraint is explicit in mix.exs.

- postgrex ≥ 0.22.2 — GHSA-r73h-97w8-m54h (channel-name SQL injection
  in Postgrex.Notifications.listen/3, High, CVSS 7.5). Affected:
  0.16.0 ≤ x < 0.22.2; we were on 0.22.0.

bandit 1.11.1 requires plug ~> 1.18, compatible with the new plug pin.

Lockfile regeneration deferred: this container's network policy blocks
repo.hex.pm so `mix deps.update bandit plug postgrex` cannot run here.
Run that command in any environment with hex access to refresh
mix.lock; mix.exs constraints guarantee resolution to safe versions.

https://claude.ai/code/session_01GeiWCLLoZmPdnjMMcy2buu

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.claude/CLAUDE.md

@@ -339,6 +339,7 @@ Resolved in recent sessions:
 - Multi-proof parsing: PROOF A(x) AND B(y) splits correctly
 - Modality compatibility validation (INTEGRITY needs semantic, PROVENANCE needs provenance, etc.)
 - proven library integrated (certificate-based JSON/CBOR bridge)
+- ZKP / sanctify integration (zkp.rs 367 LOC + zkp_bridge.rs 628 LOC + sanctify_bridge.rs 413 LOC, VQL-routed)
 - verisim-repl builds clean (67 tests pass)
 - oxrocksdb-sys C++ dependency eliminated (Oxigraph feature-flagged, redb pure-Rust backend added)
 - protoc build dependency eliminated (proto code pre-generated)