Sanitization 1.2.1

[eldryoth]

sanitization v1.2.1

Small hardening release for locked in-place fill APIs.

Added

• In-place locked fill constructors and replacement APIs for LockedSecretBytes<N> and LockedSecretVec.
• Capacity-based LockedSecretVec fill APIs for decoders that know a maximum output size and return the final initialized length.
• LockedSecretVecFillError<E> for distinguishing memory-lock, fill, and length validation errors.

Hardened

• Explicit pre-return clearing on fallible locked fill/generation error paths.
• Pre-fill compiler fences around locked fill/generation writes.
• Canary integrity checks before fixed-size locked replacements.
• Release-build capacity assertions for dynamic locked and guarded storage initialization.
• WASM compatibility backend now exposes the same fixed-size fill/replace API surface.

Validation

• Workspace tests, clippy, docs, WASM target checks, evidence validation, leakage smoke, codegen checks, and Kani verification passed.

---

This discussion was created from the release Sanitization 1.2.1.