Sanitization Rust Crate v1.0.0-rc.5

[eldryoth]

sanitization v1.0.0-rc.5

Release candidate with the latest pentest fixes and documentation updates.

Changes

• Reinitializes LockedSecretBytes canaries after secure_clear, so canary-checked locked secrets remain reusable after manual clearing.
• Requires random-canary when using canary-check on WASM, avoiding predictable deterministic canaries on targets without ASLR-backed mapping entropy.
• Retries Linux AArch64 runtime page-size auxv reads on EINTR.
• Makes the x86_64 assembly comparison accumulator contract explicit.
• Updates README, safety notes, and threat model around canary behavior, WASM limitations, and ASLR assumptions.

Verification

• Full local scripts/checks.sh passed.
• GitHub CI is green.
• Pentest follow-up is clean.

---

This discussion was created from the release Sanitization Rust Crate v1.0.0-rc.5.