docs: record windows-sys cleanup in CLAUDE.md, drop completed #85 note

CLAUDE.md

@@ -30,6 +30,7 @@ Project-specific guidance for Claude Code sessions working in `cedar-py`.
 - `Cargo.toml` has no active version overrides. The previously-pinned `rustix` workaround (for a 2024 CVE) was removed and `rustix` is now fully transitive.
 - **Pinning a specific transitive version:** prefer `cargo update --precise <ver> -p <crate>` over a `=X.Y.Z` manifest pin. Belt-and-suspenders (caret in `Cargo.toml` + precise in `Cargo.lock`) keeps the lock authoritative without freezing the manifest.
 - **Outside-contributor PRs and `Cargo.lock`:** be deliberate about transitive churn. If a contributor's PR adds/removes many lockfile entries beyond what the change requires, restore `Cargo.lock` from `main` (`git checkout main -- Cargo.lock`) and re-apply only the intended pins on top. We've done this once (PR #82) — small lockfile diffs are easier to audit and review.
+- **Collapsing a stale duplicate transitive version.** `Cargo.lock` can carry a semver-incompatible duplicate (e.g. `windows-sys 0.48` *and* `0.59`) when one consumer's version requirement is a *range* spanning both lines and the lock has a sticky old pin on that edge. Cargo only re-picks the highest in-range version when the consuming node itself changes — so `cargo update <the-consumer>` (which bumps that crate and re-resolves its edges) collapses the duplicate onto the version already in the tree. Targeted, minimal diff; prefer it over a blanket `cargo update`. PR #98 did exactly this: `cargo update winapi-util` (0.1.9→0.1.11) dropped 9 stale `windows-sys 0.48` entries by unifying onto the `0.59.0` already pulled by clap/miette/rustix/term. `cargo update -p <dup>@<oldver> --precise <newver>` is an equivalent lever but leaves a precise pin nobody later understands.
 
 ### Dependabot policy (`.github/dependabot.yml`)
 
@@ -64,4 +65,3 @@ Documented in `docs/release-process.md`. Highlights:
 - **GitHub Actions consolidation (GH issue #62):** 6 actions in `CI.yml` are on outdated major versions (e.g. `actions/upload-artifact@v4` when v7 is current). Planned approach: one consolidated PR pinning all actions to commit SHAs with tag comments. Defer until there's time to review the cross-major changelogs, and do not bundle with a release.
 - **Benchmark process improvements (GH issue #69):** Goals 2 and 3 have landed (PR #71 for the historical record + tooling; PR #84 for the median-of-N gate in `make benchmark-compare`). **Goal 1 remains open** — switching `make benchmark` / `benchmark-save` to release mode (currently debug). `benchmark-compare` is already release-mode as of PR #84.
   - **Empirical finding from PR #71's data:** medians are robust at N=5 (N=7 backfill shifted Δ by <1.3 pp on every benchmark we checked); max grows monotonically with N as more samples capture rare tail outliers and shouldn't be used for cross-state gating. The Δ max column in `HISTORY.md` is informational only.
-- **`windows-sys 0.48` transitive cleanup (GH issue #85):** `Cargo.lock` carries 9 stale `windows-sys 0.48` / `windows-targets 0.48` / `windows_*_gnu/msvc/gnullvm 0.48.5` entries pulled in via `walkdir → winapi-util → windows-sys 0.48`, which reach the tree through `lalrpop` as a build-dependency of `cedar-policy-core`. Build-dep only, Windows-only, never flows into the wheel. Not urgent; clean up when convenient.