deps: resolve direct Dependabot upgrades with compatibility proof

[betterthanclay]

Summary

Resolve the direct Dependabot upgrades for argon2 0.6.0, tree-sitter 0.27.0, and tabled 0.22.0, including tree-sitter-language 0.1.8, on current main.

Supersedes source PRs #81, #98, #101, and #102 after this aggregate merges. Keep those bot PRs open until then.

Compatibility proof

• Pinned a v0.13.0 Argon2id derived-key vector and old ciphertext. The upgraded build derives identical bytes and opens that ciphertext with the original passphrase.
• The Rust, JavaScript/TypeScript, Python, and PHP graph fixture suite passed before and after the upgrade, including representative facts and parse diagnostics.
• Pinned exact v0.13.0 plain table bytes, including padding and line breaks.
• Evidence log records the lockfile/transitive delta and validation.

Validation

• Focused secrets, codegraph, and UI tests: 178 passed.
• Full workspace: 3,922 passed across 97 test suites, 0 failed. The test command completed; a shell wrapper then failed on zsh's reserved status variable after logging the result.
• cargo deny check: passed (advisories, bans, licenses, sources).
• cargo fmt --all -- --check: passed.
• cargo clippy --all-targets --locked -- -D warnings: passed.
• effigy qa:docs: passed on the rebased head.
• git diff --check origin/main...HEAD: passed.

Queue owns independent exact-head review, hosted CI, merge, and the four bot-PR dispositions.

[betterthanclay]

Independent exact-head review of PR #118 for g10.015 at 2b3bbb1 (merge-base 1b09755 = current origin/main; working tree clean; two commits: e52a9f5 deps + 2b3bbb1 evidence log). Verdict: ready to merge.

Scope and diff

• Manifest bumps exactly match the four covered bot PRs: effigy-secrets argon2 0.5.3→0.6.0 (deps: bump argon2 from 0.5.3 to 0.6.0 #81), effigy-codegraph tree-sitter 0.26.13→0.27.0 (deps: bump tree-sitter from 0.26.13 to 0.27.0 #98), tree-sitter-language lock 0.1.7→0.1.8 (deps: bump tree-sitter-language from 0.1.7 to 0.1.8 #101, satisfied under the existing ^0.1.5 requirement), effigy-ui tabled 0.21.0→0.22.0 (deps: bump tabled from 0.21.0 to 0.22.0 #102).
• Cargo.lock delta is exactly the claimed set: argon2, tree-sitter, tree-sitter-language, tabled, plus transitives blake2 0.11.0, password-hash 0.6.1, new phc 0.6.1, and tabled_derive 0.12.0; proc-macro-error2 and proc-macro-error-attr2 dropped. Remaining hunks are dependency-edge adjustments among versions already present (cpufeatures 0.2.17 and 0.3.0 both retained, digest 0.10.7 and 0.11.3 both retained, tempfile switched getrandom 0.3.4→0.4.3; getrandom 0.2/0.3/0.4 all still in the lock). No unrelated package version changed.
• Production code untouched: effigy-secrets/src/lib.rs changes are test-only (pinned derived-key vector plus reuse of old ciphertext in an existing test); effigy-ui/src/table.rs adds a new #[cfg(test)] byte-exact table assertion. No vault format/KDF, graph schema, or table rendering changes.
• Excluded surfaces untouched: no .github/workflows, task card, handoff, or release files in the diff. CHANGELOG.md correctly unchanged — no user-visible behavior change, confirmed byte-level below. All four bot PRs verified still OPEN, per the close-only-after-merge disposition protocol. PR body is non-draft and links deps: bump argon2 from 0.5.3 to 0.6.0 #81/deps: bump tree-sitter from 0.26.13 to 0.27.0 #98/deps: bump tree-sitter-language from 0.1.7 to 0.1.8 #101/deps: bump tabled from 0.21.0 to 0.22.0 #102.

Independent compatibility verification

Reviewer-built A/B harness in a scratch crate outside the workspace, pinning both old and new versions side by side:

• argon2 0.5.3 and argon2 0.6.0 both derive exactly 9ae366cc91b47ba2598b19140035cde0e86a49dc719811965943b16eb2c8598d from the documented inputs (Argon2id v0x13, m=19456 KiB, t=2, p=1, 32-byte 0x2a salt, passphrase "correct horse battery staple"). This independently confirms the pinned vector genuinely originates from the 0.5.3-era baseline and that 0.6.0 is byte-compatible — vault compatibility is proven, not just asserted.
• Recomputed the 80-byte XChaCha20Poly1305 ciphertext from the derived key plus a 24-byte 0x07 nonce over the payload JSON {"records":{"database_url":{"value":"postgres://secret-value"}}}; it matches the test's pinned old-ciphertext vector byte-for-byte, confirming vector provenance and deterministic-compatible encryption. AEAD round trip of the pinned bytes also verified.
• tabled 0.21.0 and 0.22.0 both render exactly "Name Value \nalpha 1 \nbeta two " for the test fixture (Builder + Style::blank + Padding::new(0,2,0,0)) — plain table bytes preserved across the upgrade.
• Graph behavior: the existing Rust, JavaScript/TypeScript, Python, and PHP language indexer fixtures (13 tests) plus mixed-repository and graph JSON tests pass on the upgraded base against unchanged checked-in expectations.

Validation re-run by reviewer on the exact head

• cargo test -p effigy-secrets -p effigy-codegraph -p effigy-ui --locked: 178 passed, 0 failed (156 + 15 + 7).
• cargo test --workspace --locked: 3,922 passed, 0 failed across 97 suites — matches the evidence log exactly.
• cargo deny check: advisories ok, bans ok, licenses ok, sources ok.
• cargo fmt --all -- --check: pass. cargo clippy --all-targets --locked -- -D warnings: pass.
• effigy qa:docs: pass. git diff --check: pass.
• Hosted CI on the PR head: all 7 checks green (Lint & format, Released Surface Baseline, Supply-chain cargo-deny, Test macos-latest, Test ubuntu-latest, Validate JSON contracts, Validate docs links).

Minor, non-blocking notes

• The evidence log's lockfile sentence cites digest and tempfile edge changes but omits the argon2→cpufeatures 0.3.0 edge; both cpufeatures versions remain in the lock, so "no unrelated package version changed" stays accurate. Cosmetic only; no change requested.
• The worker-transparently-disclosed zsh status wrapper failure did not affect results; this reviewer's direct cargo test --workspace --locked run completed with 0 failures.

Acceptance oracle

Satisfied on every row: vault compatibility (fixed derived-key and ciphertext vectors), graph behavior (fixture parity), table behavior (exact bytes), targeted supply chain (exact manifest/lock diff + cargo deny + tests + CI), honest PR disposition (all four bots open pending this merge). Recommend merge; after merge, Queue closes #81, #98, #101, and #102 as superseded with the #118 merge link.