Iteration 12

P2 VERIFY: fmt+clippy+test+test-features GREEN; fixed 3 pre-existing rrbicov clippy doc errors + added the 8 batch-5 fields to the 2 PyO3 OpenDeviationBar initializers (src/helpers.rs, src/arrow_bindings.rs) that the per-crate build never compiled (committed ee7f51c7). cargo-deny FAILED on 3 PRE-EXISTING advisories (paste unmaintained = no upgrade; pyo3 0.28.3 RUSTSEC-2026-0176/0177 = upgrade to >=0.29.0) — Cargo.lock byte-identical to origin/main, batch added ZERO deps, fails on main too. Full core nextest 880/887 (the 7 fails are all pre-existing bigblack test_data/ deps, zero feature failures). P2 deny needs an OPERATOR decision (ignore-policy vs pyo3 upgrade vs accept) — loop will NOT weaken the gate or dep-bump unilaterally per HARD RULES.