release: v0.33.0 — depth-2 list<list<string>> nested-string transcoding (#286) + fuzz-CI fix

[avrabe]

v0.33.0 — depth-2 nested-string transcoding

Bundles the 5 PRs merged since v0.32.0 — closes the last gap of the #272 async cross-encoding campaign.

PR	What
#289	SR-17 de-stale (understated-gap correction)
#290	#286 5d-pre — type-carrying Indirection descriptor (behaviour-preserving)
#291	#286 5d RESULT — depth-2 list<list<string>> result transcoding
#292	#286 5d PARAM — depth-2 param transcoding (closes #286)
#293	#168 — fuzz-CI runner-drift fix

Release-time safety reconciliation

The #286 code PRs correctly deferred safety-YAML edits (the add-after-passes discipline). Reconciled in this release commit:

• SR-41 coverage extended to two-level list nesting; residual fail-loud boundary → depth-3+; cites the new d5d_* oracles.
• LS-F-27 residual fail-loud set narrowed from list<list<string>> (now transcoded) to list<list<list<string>>>.

Readiness (V-model)

• YAML OK; rivet validate 0 broken cross-refs (180/101 = unchanged pre-existing left-side baseline)
• LS-N gate 57/0/0; full meld-core suite 0 failed; clippy/fmt clean
• CHANGELOG carries the falsification statement + disclosed gaps (depth-3 fail-loud, async-lift e2e kiln-gated, Kani-not-in-CI + CBMC-intractable for #272 follow-up: deeper list nesting (list<list<string>>) — needs a recursive-copy restructure (scoped) #286, smithy: sanitizer/libc config drift recurrence on fuzz smoke jobs #168 infra root-cause open, 16 baseline implemented SRs)

Scope

Release commit touches only Cargo.toml/Cargo.lock/CHANGELOG.md + the two safety YAMLs — no Tier-5 source path, so no Mythos gate applies. Tag on green main CI; release.yml then builds the signed multi-platform assets (cosign + CycloneDX SBOM).

🤖 Generated with Claude Code

[github-actions]

LS-N verification gate

✅ 57/57 approved LS entries verified

	count
Passed (≥1 test, all green)	57
Failed (≥1 test failure)	0
Missing (no ls_*_NN_* test found)	0

_{Approved loss-scenarios.yaml entries are expected to have a
regression test named ls_<letter>_<num>_* (e.g. LS-A-11 →
ls_a_11_*). The gate runs each prefix via cargo test --lib --no-fail-fast and aggregates pass/fail/missing.}

Failed LS entries

(none)

Missing regression tests

(none)

_{Updated automatically by tools/post_verification_comment.py.
Source of truth: safety/stpa/loss-scenarios.yaml.}