fix: audit-conformance pass — DropOldest back-pressure, E2E masquerade gap, LDF panic, CI gates

[SoundMatt]

Summary

Applies the x-Net gap-audit worklist for rust-LIN (5 items, all with pre-made diffs; all applied cleanly against current origin/main):

ID	Severity	Summary
rust-LIN-01	High (cross-repo XR-06)	RELAY adapter's DropOldest back-pressure policy silently degraded to DropNewest
rust-LIN-02	High	E2E Receiver never validated DataID/SourceID — false ASIL-B masquerade protection
rust-LIN-03	Medium	LDF extract_bits panics on shift overflow for signals >= 64 bits (hostile-input DoS)
rust-LIN-04	Medium	CI coverage "gate" computed a percentage but never enforced it
rust-LIN-05	Medium	ASIL-B strict safety check masked with || true

Spec verification

• rust-LIN-01: RELAY spec §14 step 3 (spec/relay-spec.md:791): "DropOldest: drain one message from the channel, then enqueue the new one." The adapter's forwarding task previously used identical tx.try_send logic for both DropNewest and DropOldest, and additionally hard-coded the bus subscription to DropNewest/rate_limit_per_sec: 0 regardless of the caller's real SubscriberOptions. bus.rs's SubInner already implements all three policies correctly, so the fix is to delegate to it with the caller's real options and forward with a blocking send (no second, policy-less drop layer).
• rust-LIN-02: AUTOSAR E2E design intent — DataID coverage exists specifically to prevent masquerade; a receiver using an explicit-DataID wire format (as this one does — DataID/SourceID transmitted in the header) must compare the received identifiers against its own configuration. CRC alone only proves integrity of whatever bytes the sender put on the wire, not identity. Receiver::unwrap now checks data[0..2]/data[2..4] against self.cfg.data_id/self.cfg.source_id after the CRC check and returns a new ErrorKind::IdentifierMismatch on mismatch.
• rust-LIN-03: LIN 2.x / ISO 17987 caps frame data at 8 bytes (64 bits); a signal can't exceed the frame carrying it, so a declared bit_width >= 64 is malformed/hostile input. The module's own documented contract ("Never panics; malformed input results in a partial Db or an error", src/ldf/mod.rs) is violated by direct inspection prior to this fix. Bounded the extraction loop so bits >= 64 are never shifted.
• rust-LIN-04 / rust-LIN-05: project-declared CI/process claims, verified directly against .github/workflows/ci.yml.

Regression-test proof (memory-safety / DoS class: rust-LIN-03; behavioral-security class: rust-LIN-01, rust-LIN-02)

rust-LIN-01 — two new adapter-level tests in src/adapt.rs using a PreloadedBus test double that pushes frames directly into a real SubInner before the adapter's forwarding task is spawned (avoids any scheduling race):

• subscribe_drop_oldest_evicts_oldest_not_newest: pushes frames 1..=5 against a capacity-2 DropOldest queue; asserts the two survivors are 4 and 5 (the most recent), never 1/2.
• subscribe_forwards_caller_rate_limit_per_sec: proves rate_limit_per_sec is forwarded rather than hard-coded to 0.

I manually verified both fail against the pre-fix adapter code (grafted the new tests onto the pre-fix src/adapt.rs, ran them, confirmed failure with the exact "before" symptoms — frames 1/2 delivered instead of 4/5, and a second frame arriving when the rate limiter should have suppressed it), then confirmed they pass against the fix.

rust-LIN-02 — src/safety/mod.rs: unwrap_rejects_wrong_data_id, unwrap_rejects_wrong_source_id (both build an internally self-consistent, CRC-valid frame under a different sender Config and confirm the receiver rejects it with IdentifierMismatch), plus unwrap_accepts_matching_identifiers as the matching happy-path control.

rust-LIN-03 (fuzz-style malformed-input regression, not just happy-path) — src/ldf/mod.rs:

• extract_bits_does_not_panic_at_64_bits / extract_bits_does_not_panic_beyond_64_bits: direct unit tests at and beyond the overflow boundary.
• decode_does_not_panic_on_oversized_signal_from_hostile_ldf: end-to-end test that parses a hostile .ldf declaring a 128-bit signal and calls Db::decode() on it, proving the whole pipeline (untrusted file -> parse -> decode) survives without panicking, matching the module's documented contract.

Test plan

• cargo build --all-targets
• cargo test --locked — 164 tests (116 unit + 46 integration + 2 doc), all green
• cargo clippy --all-targets -- -D warnings — clean
• cargo fmt --check — clean
• New regression tests independently confirmed to fail against pre-fix source (rust-LIN-01) before confirming they pass against the fix
• rsfusa check --strict — not run locally (rsfusa not installed in this environment); CI's now-enforced strict gate (rust-LIN-05) is the first live check

Version bumped 0.4.2 -> 0.4.3 (bugfix release — DropOldest and the E2E identifier check are corrections to already-declared capabilities, not new API surface) with matching updates to the safety-artifact version headers and a new SAFETY_MANUAL.md version-history row.