fix: harden simulator CORS and dependencies

[nicholas-ruest]

Summary

• replace credentialed arbitrary-origin CORS reflection with an exact allowlist from CORS_ALLOWED_ORIGINS
• preserve server-to-server requests that do not send Origin
• remove unused claude-flow and refresh vulnerable Node transitive dependencies
• restore deterministic Rust 1.83 format, strict-Clippy, all-feature build, release-test, coverage, multi-OS CI, and checksum-verified kubeval 0.16.1
• pin optional organization dependencies to immutable revisions
• run current cargo-audit 0.22.2 with a separate Rust 1.88 audit toolchain so CVSS 4.0 advisories parse correctly

Frozen acceptance contract

1. Existing Node and Rust behavior remains passing.
2. Exact configured origins receive credentialed CORS permission.
3. Unconfigured origins receive no CORS permission headers.
4. Requests without Origin continue to work.
5. Node and Rust security gates pass without ignored advisories.
6. Rust format, strict all-target/all-feature Clippy, and release tests pass.
7. CI remains Linux-first and does not hide matrix failures.

Evidence

Check	Baseline	Candidate
npm test	64 passed, 0 failed	72 passed, 0 failed
Arbitrary-origin credentialed CORS	exposed	denied
npm audit --omit=dev	96 findings	0 findings
Production dependencies	903	75
Rust format / check / strict Clippy	not reproducible	exit 0 / 0 / 0
Rust release suite	not reproducible at declared Rust 1.75	352 passed, 0 failed, 8 ignored
RustSec vulnerabilities	10	7 (gate failed)

The compatible lock updates eliminate RustSec findings in bytes, crossbeam-epoch, and h2 0.4. Seven findings remain through time and older major-version graphs (h2 0.3, idna 0.4, protobuf 2, rustls-webpki 0.101). No advisory is ignored.

Pinned tools: upstream ruvnet/metaharness@ea287d6ef7548b0b32fa3e20956fa548cfe51edb, metaharness@0.4.17, @metaharness/darwin@0.10.3, @metaharness/flywheel@0.1.12.

Darwin real and agent sandboxes each ran one generation with two deterministic children; both candidates tied the parent and were rejected. Flywheel's signed replay passed, but the exact safety gate rejected the source candidate because RustSec still reports seven vulnerabilities (finalPolicy=baseline, no promotion).

Merge status

Do not merge yet. This PR remains non-draft, but the RustSec/Flywheel gates are red. The remaining dependency-major upgrades must be implemented and revalidated first.

Rollback

Before merge, reset this candidate branch by reverting 8c8d01c419cd0df3006601a83c8846f3ebff40d8, 1b2411b44f61a4f2e2b1088da77dd36e757316cd, 26b4607bfce40629b140777a71185e3bcbe367da, 7ae4c4d2892c37ec6c5a2665c48e7e49fc76467f, then 4b73f940f5c8112cc772bdc0848d35869d4c2c96. After any eventual merge, revert the merge commit. Browser callers must configure exact HTTPS origins with CORS_ALLOWED_ORIGINS; wildcard credentialed CORS is intentionally unsupported.