Finalize 1.3.7 release documentation

Author: eldryoth

CHANGELOG.md

@@ -18,7 +18,8 @@
 - Pinned GitHub Actions to the latest audited releases: checkout `v6.0.2`,
   rust-cache `v2.9.1`, and install-action `v2.83.0`.
 - Added exact-version cargo-nextest installation and the 210-test nextest suite
-  to GitHub CI, with install-action fallback disabled.
+  to GitHub CI, with install-action fallback disabled for supported binaries
+  and cargo-deny installed through an exact-version locked Cargo command.
 - Hardened Tokio companion cleanup with volatile wipes for fixed reader
   buffers and RAII-wiped read-all allocations that also cover cancellation.
 - Bounded Tokio limited-helper over-read to one lookahead byte and documented

README.md

@@ -56,8 +56,9 @@ and normal strict decode when the binary is compiled with
 
 The latest patch in this line is `1.3.7`, which keeps all workspace crate
 versions aligned, moves release builds to Rust `1.97.0`, and refreshes audited
-companion dependencies and GitHub Action pins without changing encode/decode
-behavior or SIMD admission.
+companion dependencies and GitHub Action pins. It also hardens Tokio companion
+cancellation cleanup and bounds limited-helper over-read and cleanup cost
+without changing core encode/decode behavior or SIMD admission.
 The stronger RISC-V RVV proof and admission review is scheduled for `1.3.8`;
 until then, RISC-V remains QEMU-tested scalar/fallback-only. The workspace
 crate family stays version-aligned at `1.3.7`.

release-notes/RELEASE_NOTES_1.3.7.md

@@ -21,7 +21,9 @@ the `base64-ng` crate family.
 - Pinned GitHub Actions to checkout `v6.0.2`, rust-cache `v2.9.1`, and
   install-action `v2.83.0`, using their verified release commits.
 - Added the 210-test nextest suite to GitHub CI and disabled install-action
-  fallback installation.
+  fallback installation for supported binaries. Cargo-deny uses a separate
+  exact-version locked Cargo installation because its current binary is not
+  available through install-action.
 - Hardened Tokio reader-buffer cleanup and made read-all temporary allocations
   wipe through RAII on success, error, and cancellation.
 - Limited oversized-input detection to one lookahead byte and documented the
@@ -38,7 +40,7 @@ the `base64-ng` crate family.
 ## Notes
 
 No core encode/decode logic, SIMD admission scope, unsafe boundary, target
-evidence, or core zero-dependency policy changes in this release. Existing RISC-V QEMU
-evidence remains valid functional and fallback evidence, but it is not real
-hardware acceleration, performance, timing, side-channel, or
+evidence, or core zero-dependency policy changes in this release. Existing
+RISC-V QEMU evidence remains valid functional and fallback evidence, but it is
+not real hardware acceleration, performance, timing, side-channel, or
 register-retention proof.