Harden supply chain and optimize Rust builds

[richardikeda]

What

Hardens the dependency and GitHub Actions supply chain and completes the compatible, measured portions of Rust build-performance item 9 in docs/p0.md.

Why

Aikido reported a stale vulnerable fuzz lockfile, mutable third-party Action references, broad release-token permissions, and upstream-retained dependency findings. The P0 audit also identified avoidable dependency features, redundant compilation, slow test scheduling, large debug artifacts, and monomorphization at an MLS callback boundary. This PR addresses those findings before the MLS architecture phase without changing protocol behavior.

Changes

• Pin every remote GitHub Action to a reviewed full commit SHA and scope release permissions to least privilege.
• Refresh and separately audit fuzz/Cargo.lock; document time-bounded upstream advisory dispositions and compensating controls.
• Remove unused Axum, Criterion, MLS Rayon, Native TLS, Plotters, and related transitive feature paths while preserving required behavior.
• Configure line-tables-only development debug information to retain file/line diagnostics with substantially smaller build artifacts.
• Adopt pinned cargo-nextest 0.9.137 for binary tests, retain Cargo doctests, and upload default/all-feature JUnit timing reports for 14 days.
• Remove the redundant workspace build only from the stable row that already compiles both required feature sets.
• Make the MLS external-commit resynchronization generic wrapper delegate to one concrete callback boundary, reducing its measured LLVM IR by 95.2%.
• Evaluate Windows rust-lld and local sccache; reject project-wide adoption because the measured gains did not justify the portability and cache complexity.
• Define a comparable-sample build-regression policy and record reproducible local and hosted evidence.

Security Impact

• Does this change affect security? Yes, positively for supply-chain controls; protocol behavior is unchanged.
• CI references are immutable, release-token permissions are narrowed, and both normal and fuzz lockfiles are audited.
• The MLS refactor preserves epoch validation, recovery ordering, replay rejection, malformed-input behavior, and all protocol types.
• Required mls-rs RFC, serialization, standard-library, and tree-index features remain explicit; only its unused parallel feature path is removed.
• No cryptography, canonical CBOR, signatures, cfg_hash, wire format, authentication, authorization, PoW policy, or validation rule changed.

Tests

Executed locally:

• cargo-nextest default features: 214/214 passed
• cargo-nextest all features: 215/215 passed
• Cargo doctests for default and all features
• cargo fmt --all -- --check
• cargo clippy --workspace --locked --all-targets --all-features -- -D warnings
• RUSTDOCFLAGS=-Dwarnings cargo doc --workspace --locked --no-deps --all-features
• cargo bench -p spex-bridge --locked --features benchmarks --no-run
• targeted MLS concurrent-update and recovery tests
• cargo audit --file Cargo.lock
• cargo audit --file fuzz/Cargo.lock
• cargo deny check
• scripts/release_gate_docs.sh
• scripts/release_gate_negative_test.sh

Nextest listed the same 214 default-feature and 215 all-feature tests as Cargo. The default suite measured 69.01 seconds versus 182.80 seconds with Cargo's executor on the same host and built artifacts, a 62.2% reduction. Cargo remains responsible for doctests.

Documentation

Updated:

• docs/p0.md
• docs/build-performance.md
• docs/security-advisory-exceptions.md
• docs/security.md
• docs/index.md
• TESTS.md
• CONTRIBUTING.md
• CHANGELOG.md

Versioning

• New version in VERSION.md: 1.0.31

Notes for Reviewers

• Review the time-bounded Yamux 0.12 exception and gate that forbids legacy configurators.
• Review the explicit mls-rs features and the concrete callback boundary in spex-mls.
• Local wall-clock build comparisons affected by competing host CPU load are recorded but are not claimed as causal improvements. Deterministic dependency, artifact-size, test-scheduling, and LLVM-line results are reported separately.
• Linux lld/mold, keyring replacement, and cross-linker reproducibility remain explicitly unchecked until they can be measured on compatible platforms; no unsupported default was introduced.

Hosted validation

GitHub Actions run 30215940075 passed the complete required gate. On Ubuntu stable, Nextest passed 214/214 default-feature tests in 149.539 seconds and 215/215 all-feature tests in 151.325 seconds; Cargo doctests also passed. The workflow published rust-test-timings-Linux-stable and release-critical-test-timings. This first run followed manifest/profile changes and is evidence of correctness and observability, not a warm-cache performance claim.