Resolves RUSTSEC-2026-0097 (rand 0.10.0 unsoundness): burn 0.21 brings a
transitive rand bump to 0.10.1, the patched version. uuid 1.23.1 follows
naturally. Cargo audit drops from 7 → 6 advisories; the remaining 6 are
all transitive within the burn ML stack (bincode, core2, paste,
rustls-pemfile, lru) and require upstream fixes. Workspace builds clean;
verisim-tensor tests still pass.

https://claude.ai/code/session_01GeiWCLLoZmPdnjMMcy2buu

Addresses three GHSA advisories matching mix.lock entries:

- bandit ≥ 1.11.1 — GHSA-rf5q-vwxw-gmrf (chunked-trailer DoS, High,
  CVSS 8.7). Affected: 1.6.0 ≤ x < 1.11.1; we were on 1.10.3.

- plug ≥ 1.19.2 — GHSA-468c-vq7p-gh64 (multipart-header buffer
  exhaustion, High, CVSS 8.2). Affected: 1.19.0 ≤ x < 1.19.2; we were
  on 1.19.1. Pinned directly even though plug is transitive via
  bandit, so the constraint is explicit in mix.exs.

- postgrex ≥ 0.22.2 — GHSA-r73h-97w8-m54h (channel-name SQL injection
  in Postgrex.Notifications.listen/3, High, CVSS 7.5). Affected:
  0.16.0 ≤ x < 0.22.2; we were on 0.22.0.

bandit 1.11.1 requires plug ~> 1.18, compatible with the new plug pin.

Lockfile regeneration deferred: this container's network policy blocks
repo.hex.pm so `mix deps.update bandit plug postgrex` cannot run here.
Run that command in any environment with hex access to refresh
mix.lock; mix.exs constraints guarantee resolution to safe versions.

https://claude.ai/code/session_01GeiWCLLoZmPdnjMMcy2buu

Brings the workspace to clippy-clean under --all-targets -D warnings,
fixes broken benchmark targets, applies cargo fmt across the tree, and
mirrors the existing GitLab security/lint/test stages as GitHub Actions
so PR authors see the same checks before merge.

Clippy/lint fixes (across 15+ crates):
- Drop dead Node.level field in HNSW (level info lives in neighbors.len)
- Replace x % 2 != 0 with !x.is_multiple_of(2) (zkp.rs, auth.rs)
- Derive Default for PrivacyLevel, DriftPolicy, IsolationLevel
- Add Default impl for TransactionId, QualityReconciliationStrategy
- Rename TransactionId::from_str to from_string (avoids FromStr clash)
- Annotate too_many_arguments on octad/drift APIs (refactor would be
  invasive without semantic gain)
- Collapse nested ifs in vql.rs find_where_id, elide lifetimes
- Use struct-update syntax in OctadInput / RegenerationConfig builders
- Drop &h to h on Sha256::update (h is Copy)
- Fix HTTP URL literals in doc comments and unclosed HTML tags

Benchmark fixes:
- Switch from OxiGraphStore (now feature-gated, KNOWN-ISSUES #24) to
  SimpleGraphStore — drop-in pure-Rust replacement
- Add provenance + spatial stores to InMemoryOctadStore::new() calls
  (9 modalities now, was 7)
- Add verisim-provenance + verisim-spatial path deps to benches/
- Replace black_box(unit_returning_call) with explicit black_box(())

Doc warnings:
- Fix unresolved [`AdaptiveTuner`] link in profiler.rs
- Backtick the generic in `Version<T>` doc to avoid HTML parse
- Use backticks not quotes for example URLs

GitHub Actions added (.github/workflows/):
- rust-ci.yml: fmt, clippy (all-targets, -D warnings), test, doc
  (-D warnings via RUSTDOCFLAGS), cargo-audit, bench-compile
- elixir-ci.yml: format check, compile --warnings-as-errors, mix test,
  mix hex.audit, mix deps.unlock --check-unused

Dependabot fix:
- Correct ecosystem "weeklymix" → "mix" (was a typo, never matched)
- Point mix at /elixir-orchestration, npm at /playground (was scanning
  repo root, finding nothing)
- Drop pip + nix entries (no Python or flake files exist)

Verification:
- cargo test --workspace: 567 passed, 0 failed, 6 ignored
- cargo clippy --workspace --all-targets -- -D warnings: clean
- cargo doc --workspace --no-deps: clean
- cargo bench --no-run: clean

https://claude.ai/code/session_01GeiWCLLoZmPdnjMMcy2buu

Pre-flight for the new .github/workflows/elixir-ci.yml which runs
mix format --check-formatted. 61 files were unformatted; this catches
them up so the freshly-added CI workflow doesn't fail on first run.

Pure whitespace/style — no semantic changes.

https://claude.ai/code/session_01GeiWCLLoZmPdnjMMcy2buu