chore: pre-release maintenance checklist

[chaliy]

Summary

• cargo-vet: Add exemption for pyo3-build-config:0.28.2 (new transitive dep)
• Threat model: Sync public doc with spec — add Python (TM-PY-) threat table, Git (TM-GIT-) security section, and git test references
• Orphaned TODOs: Rename TODO: headings to Known sections in compatibility.md, 004-testing.md, 009-implementation-status.md

Maintenance Checklist Results

Section	Status
1. Dependencies	cargo update ✓, cargo audit ✓ (3 warnings, 0 vulns), cargo deny ✓, cargo vet ✓
2. Security	Threat model reviewed, public doc synced with spec
3. Tests	just test ✓ — all unit + failpoint tests pass
4. Documentation	cargo doc clean (0 warnings), CHANGELOG current
5. Examples	All 15 Rust examples + feature-gated (python, git) pass
6. Specs	Status fields accurate, TODO comments cleaned up
7. Code Quality	cargo fmt ✓, cargo clippy ✓, no stale TODOs in src
8. Agent Config	AGENTS.md accurate, spec table complete

Test plan

• cargo fmt --check
• cargo clippy --all-targets --all-features -- -D warnings
• cargo test --all-features
• cargo vet
• cargo doc --all-features --no-deps (0 warnings)

https://claude.ai/code/session_012Au6KZ2BqLnfn7Kk5tb5Gz