fix: STPA-Sec round 3 — artifact updates + 3 hardening fixes

[avrabe]

Summary

STPA-Sec cross-reference audit: mapped all 35 hazards and 33 system constraints against actual code state. Updated artifacts to reflect PR #80 fixes, identified 3 new gaps, implemented fixes.

STPA Artifact Updates

• Documented status of all R1+R2 fixes (14 from PR fix: 14 security hardening fixes from deep audit #80)
• Added 3 new hazards: H-36 (cache flooding), H-37 (PATH injection), H-38 (MCUboot partial-image)
• Added 3 new system constraints: SC-34, SC-35, SC-36
• Added 3 new attack scenarios: AS-34, AS-35, AS-36

Code Fixes

• SC-34 / H-36: MemoryProofCache now enforces max_entries (default 10,000) with oldest-entry eviction. Prevents cache flooding DoS (AS-34)
• SC-35 / H-37: BuildEnvironment::capture() resolves and logs absolute tool paths. Supports WSC_<TOOL>_PATH override env vars for operators to pin trusted binaries (AS-35)
• SC-36 / H-38: MCUboot parser rejects images where trailing content exceeds 8KB (MAX_TLV_OVERHEAD), preventing partial-image signature attacks where ih_img_size is set smaller than actual payload (AS-36)

Test plan

• cargo build — clean
• cargo test — 766 passed, 0 failed
• CI pipeline

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 47.14286% with 37 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/lib/src/signature/keyless/proof_cache.rs	26.66%	22 Missing ⚠️
src/lib/src/format/mcuboot.rs	25.00%	9 Missing ⚠️
src/lib/src/build_env.rs	78.57%	6 Missing ⚠️

📢 Thoughts on this report? Let us know!