merge calabro.io/zat: CBOR/CAR/MST robustness + 214 new tests
Merges Jim Calabro's comprehensive correctness improvements:
- non-minimal CBOR encoding rejection (RFC 8949)
- UTF-8 validation on text strings
- map key sort order + duplicate key rejection
- safe integer arithmetic throughout (std.math.add/cast)
- errdefer on all decode allocations
- low-level zero-copy CBOR read/write API
- MST tests ported from atmos, delete rebalancing fix
- CAR v1 validation gaps, readUvarint overflow fix
- ECDSA signature verification overflow fix
- firehose smoke test against live production data
- CBOR codec benchmarks
decode+verify throughput: 290k → 202k fps (still 13x faster than Go).
the regression is from correctness checks that were missing before.
also: bump zig to 0.16.0-dev.3070, update CI, fix tangled.org URLs.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>