[vxfemboy]

Summary

This PR addresses all active CI failures on main following PR #164, specifically:

1. cargo deny Advisories:

   • Updates crypto-bigint to 0.7.10 and ctutils to 0.4.6, resolving RUSTSEC-2026-0387 (timing variability in arithmetic) and RUSTSEC-2026-0385 (non-constant-time mask generation).
   • All 4 checks in cargo deny check (advisories ok, bans ok, licenses ok, sources ok) pass cleanly.

2. Mutation Testing Rigor (cargo-mutants):

   • crates/yip-obf:
     • Eliminates infinite-loop timeout in obfuscate_into by refactoring the while loop to a safe, idiomatic chunks_mut(8) slice iterator.
     • Replaces manual if raw_wire_len < max_budget comparison in round_to_bucket with raw_wire_len.max(max_budget), removing the uncatchable equivalent mutant.
     • Adds skip_calls = ["reserve"], preventing synthetic mutations on non-binding capacity allocation hints.
     • Result: 100% mutation score (73 caught, 5 unviable, 0 missed, 0 timeouts).
   • crates/yip-crypto:
     • Refactors slice extraction in Handshake::read_message with .get(..PQ_CIPHERTEXT_LEN) and adds test coverage for truncated handshake messages (pq_handshake_read_message_rejects_truncated_message).
     • Documents and excludes the 7 equivalent mutants in pq_encapsulate where manual ByteDecode_12 validation is duplicate with ml-kem-512's own internal ByteDecode_12 checks.
     • Result: 100% mutation score (0 missed, 0 timeouts).
   • crates/yip-transport:
     • Adds unit tests in crates/yip-transport/src/lib.rs for set_symbol_size, symbol_size, observe_ingress, and fec_recovered_count.
     • Adds symmetric flow key assertion in crates/yip-transport/src/classify.rs verifying FlowKey::canonical.
     • Adds state tracking unit test for PlpmtuController::active_probe_id across probing and converged states in crates/yip-transport/src/plpmtu.rs.
     • Adds K=1 repair symbol index and recovered_count assertions in crates/yip-transport/src/fec.rs.
     • Fixes last shard length calculation in oversized_object_guard_rejects_before_touching_shards so that object size bounds checking is isolated and verified.
     • Adds exact inclusive deadline boundary test (now_ms == expires_at_ms) for both decode and FIFO queue sweep in FecReassembler.
     • Refactors received shard padding in FecReassembler::push and documents proven equivalent Vec::resize no-op mutation in .cargo/mutants.toml.
     • Result: 100% mutation score (0 missed, 0 timeouts).

3. Workspace-Wide Verification:

   • Full workspace tests run (cargo test --workspace) with 100% pass rate.
   • Quality gates verified: cargo fmt --check, cargo clippy --workspace --all-targets -- -D warnings, cargo shear, graph checks, and wire-format diagram checks all pass.