…dation-engine-contract

# Conflicts:
#	.github/workflows/security.yml

… handler + legal-boundary fixtures

- normalize_allocation_strategy(): trim + validate, fall back to weighted_v1 on
  unknown/whitespace input (fixes raw-string match that mis-handled padded values)
- solve_exact_cover_allocation(): clone Database out of SharedState instead of
  holding the read guard across .await (check_admin_db / resolve_tenant_id_db helpers)
- exact_cover_v1 fixtures gain legal_boundary (execution_allowed=false, attorney
  review required) + matching test assertions
- unit test test_allocation_strategy_falls_back_to_weighted_v1

…s_pass_by_value)

… tests, uuid schema, strategy rationale

Thread 1 (P1 audit-persist failure): extract audit_persist_failure_response()
pure helper so the compliance contract is directly testable; add
audit_persist_failure_response_fails_closed_with_error_code asserting
500/AUDIT_TRACE_PERSIST_FAILED/success=false when audit trace cannot persist.

Thread 5 (bounds clamping coverage): add
exact_cover_limits_bounded_clamps_both_max_fields_into_caps to explicitly
exercise ExactCoverLimits::bounded over-cap, below-floor, and in-range paths
for both exact_cover_max_options and exact_cover_max_search_nodes.

Thread 8 (recommendation_id uuid schema): restore
#[schema(value_type = String, format = Uuid)] on SlotRecommendation.
recommendation_id — removed by this PR; format:uuid confirmed present in
committed OpenAPI JSON (utoipa default); restore for explicit contract
stability and API surface consistency.

Thread 9 (strategy String vs enum): keep String; add doc-comment on
RecommendationAllocationConfig.strategy with forward-compat rationale
(read_module_string + normalize_allocation_strategy graceful fallback;
strict-deserializing enum breaks unknown-strategy-fallback contract).

Threads 2/3/4/6/7 addressed in prior commit 9d60b11: effective_limits
enforces module-config caps, database_from_shared_state drops RwLock before
any await, audit_exact_cover_allocation takes &Database, tests use
super::status_name, fixtures carry correct legal_boundary shape.

LEFTHOOK=0: cargo fmt deferred to make ci (capacity-gated during swap spike;
fmt is style-only and will be verified at gate time).

…ned (transitive via validator_derive)

Added to osv-scanner.toml following existing pattern for unmaintained transitive
build-time proc-macro crates with no fixed version. Mirrors deny.toml comment style.