fix(deps): clear all 100 known vulnerabilities; the CI red was real

`dependency_scan.sh` had been failing CI on the port branch, and it was right
to: pip-audit reported 100 known vulnerabilities across 15 packages, including
`cryptography` itself — the library doing the vault's actual encryption.

Raised the floors to the fixed versions pip-audit named. `pip-audit` on the
regenerated lock now reports zero (one ignored exception remains, the
pre-existing GHSA-wj6h-64fc-37mp).

The one that needed judgement was starlette. It was pinned `<0.48` "must
remain compatible with FastAPI", which kept seven advisories permanently open.
That ceiling predated fastapi 0.141, which requires `starlette>=0.46` with no
upper bound — so the pin was protecting against a constraint that no longer
exists. Lifting it took starlette across a major version (0.47 -> 1.6), which
is why this was verified rather than assumed:

  - 1223 Python tests pass, 171 of them API tests
  - the API app builds all 64 routes and still answers 401 for a missing
    token, a bad token, and 404 for an unknown path
  - cross_impl_check: 41/41
  - differential fuzz: no divergences

poetry.lock was regenerated too. It dated from March, and `poetry check --lock`
reported it inconsistent with pyproject.toml — CI runs `poetry install`, so
that alone would have kept the build red no matter what else was fixed.

None of this touches the TypeScript port, which has an empty production
dependency list. It matters because the Python implementation is still the
normative reference and still what a user runs today.

Also wires the differential fuzzer into ts-parity: three fixed seeds so a
regression is deterministic and bisectable, plus one seed derived from the run
id so the explored input space grows over time rather than freezing at
whatever was chosen today.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01Vtx94nXDmNgXEeThUZP4QN

.github/workflows/ts-parity.yml

@@ -8,6 +8,7 @@ on:
       - "src/**"
       - "scripts/generate_ts_port_fixtures.py"
       - "scripts/cross_impl_check.py"
+      - "scripts/differential_fuzz.py"
       - ".github/workflows/ts-parity.yml"
   pull_request:
     branches: ["**"]
@@ -16,6 +17,7 @@ on:
       - "src/**"
       - "scripts/generate_ts_port_fixtures.py"
       - "scripts/cross_impl_check.py"
+      - "scripts/differential_fuzz.py"
       - ".github/workflows/ts-parity.yml"
 
 jobs:
@@ -131,6 +133,46 @@ jobs:
       - name: Cross-implementation compatibility
         run: poetry run python scripts/cross_impl_check.py
 
+  # Differential fuzzing: random inputs to BOTH implementations, compared as
+  # canonical JSON. Fixtures prove agreement on inputs a human chose; this
+  # proves it on inputs nobody chose, which is where the bugs that survive to
+  # production live. It found a real silent-divergence defect in canonical
+  # number encoding the first time it ran at scale.
+  differential-fuzz:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+      - name: Enable pnpm via corepack
+        run: corepack enable
+      - name: Install JS dependencies
+        run: pnpm install --frozen-lockfile
+        working-directory: js
+      - name: Install Poetry
+        run: pipx install poetry
+      - name: Install Python dependencies
+        run: poetry install --no-interaction --no-ansi
+      # Fixed seeds so a regression is deterministic and bisectable: the same
+      # commit always gets the same cases.
+      - name: Differential fuzz (fixed seeds)
+        run: |
+          for seed in 1 2 3; do
+            poetry run python scripts/differential_fuzz.py --cases 150 --seed "$seed"
+          done
+      # Plus one seed nobody has run before, so the explored input space grows
+      # over time instead of freezing at whatever was chosen today. The script
+      # prints its seed, so a failure here is still reproducible exactly.
+      - name: Differential fuzz (exploratory seed)
+        run: |
+          poetry run python scripts/differential_fuzz.py \
+            --cases 150 --seed "${{ github.run_id }}"
+
   # The fixtures are committed, so the parity job never regenerates them.
   # This job proves the committed fixtures actually come from the committed
   # generator: it regenerates from Python and fails on any drift.