fix(ci): green the 8-week ClusterFuzzLite red, correct a 2-major-version pin comment, re-key a stale audit path

.github/workflows/cflite_batch.yml

@@ -14,7 +14,14 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        sanitizer: [address, undefined]
+        # `undefined` is NOT a valid cargo-fuzz sanitizer. cargo-fuzz accepts
+        # only address/leak/memory/thread/none, so the UBSan leg failed at
+        # "Build Fuzzers (undefined)" every week from at least 2026-06-07 to
+        # 2026-07-26 with:
+        #   error: invalid value 'undefined' for '--sanitizer <SANITIZER>'
+        # It is schedule-triggered, so it never showed on the main-branch
+        # board. cflite_pr.yml was already corrected; this file was missed.
+        sanitizer: [address]
     steps:
       - name: Build Fuzzers (${{ matrix.sanitizer }})
         id: build

.github/workflows/codeql.yml

@@ -39,12 +39,12 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3.28.1
+        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3.28.1
+        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
         with:
           category: "/language:${{ matrix.language }}"

.gitignore

@@ -114,3 +114,19 @@ ai-cli-crash-capture/
 # Fuzz harness build artifacts
 fuzz/target/
 rust-core/fuzz/target/
+
+# Local database files
+*.db
+*.db-journal
+*.db-shm
+*.db-wal
+
+# Local caches and agent worktrees
+.cache/
+.claude/
+
+# Local export and build outputs
+/exports/*.json
+/exports/*.lgt
+composer/*.beam
+composer/build/

audits/assail-classifications.a2ml

@@ -30,7 +30,7 @@
   ;; inside `try { } catch` returning result<_, VeriSimError.t>. The
   ;; graceful degradation the finding asks for is already present.
   (classification
-    (file "connectors/clients/rescript/src/VeriSimVql.res")
+    (file "connectors/clients/rescript/src/VeriSimVcl.res")
     (category "UnsafeDeserialization")
     (audit "try-wrapped stringify→parseExn round-trips")
     (rationale "parse of self-stringified JSON inside try; cannot throw on external input"))