Iteration 13

P2 DEFERRED per operator decision (ignore paste, defer pyo3). deny.toml now ignores paste RUSTSEC-2024-0436 (unmaintained, no upgrade, triaged like the rustls-pemfile precedent). The 2 real pyo3 0.28.3 vulns (RUSTSEC-2026-0176/0177, fix=pyo3>=0.29 breaking bump) are NOT masked — tracked as separate security task issue #545. check-full: fmt+clippy+test+test-features GREEN; deny stays RED on pyo3 until #545. Core nextest 880/887 (7 fails all pre-existing bigblack test_data/, zero feature failures). PR #544 body now carries the per-feature oracle-residual table + P2 verification table + attestation. P2 cannot formally exit until #545 lands -> LOOP PAUSED at P2 (not P3). Committed 9387e654. NO gate weakened, NO unilateral dep bump.