Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/dependabot.yml:
- Around line 8-11: Add an explicit open-pull-requests-limit to the
github-actions dependabot block: update the block that currently contains
package-ecosystem: "github-actions", directory: "/", schedule: interval:
"weekly" to include open-pull-requests-limit (e.g., set to 5) so the
github-actions updates are capped similarly to the cargo block and prevent
unbounded PR creation.

In @.github/ISSUE_TEMPLATE/bug_report.md:
- Line 28: Update the example Rust version in the bug report template so it
matches the project's MSRV: replace the string "Rust Version [e.g. 1.75]" with
an updated example such as "Rust Version [e.g. 1.88]" and add a short note
reminding reporters to use the project's MSRV (1.88) when reproducing issues;
ensure the exact template text "Rust Version [e.g. 1.75]" is updated wherever it
appears.

In @.github/PULL_REQUEST_TEMPLATE.md:
- Around line 20-23: Add a "Mutation Tests" checkbox to the PR checklist in the
template so contributors remember to run the project's mutation test step;
specifically, update the checklist section that currently lists "Unit Tests",
"BDD Tests (`cargo xtask bdd`)", "Property Tests", and "Manual Integration
Tests" by inserting a new item like "Mutation Tests (`cargo xtask mutants`)"
adjacent to those entries (ensure the wording matches the CLI `cargo xtask
mutants` so it's discoverable).

In `@Cargo.toml`:
- Line 20: Centralize p256, sha2, and signature into the root
[workspace.dependencies] and switch the per-crate declarations to reference the
workspace to avoid version divergence: add p256 = "0.13.2" (reconciling to the
version used by uselesskey-bdd), sha2 = "0.10", and signature = "2" under
[workspace.dependencies], then in each crate manifest that currently declares
them (e.g., uselesskey-ecdsa, uselesskey-rustcrypto, fuzz, tests, interop-tests,
etc.) replace the inline version specs with p256 = { workspace = true }, sha2 =
{ workspace = true }, signature = { workspace = true } so all crates use the
single workspace-managed versions.

In `@CODE_OF_CONDUCT.md`:
- Line 130: Replace the stale/non-standard URL target for the [Mozilla CoC]
reference by updating the link destination to the canonical Mozilla diversity
page (use https://github.com/mozilla/diversity) so the `[Mozilla CoC]` reference
resolves to the standard enforcement ladder; edit the link text target in the
CODE_OF_CONDUCT.md entry that defines `[Mozilla CoC]` accordingly.
- Around line 5-6: Replace the incorrect word "harass-free" with
"harassment-free" in CODE_OF_CONDUCT.md so the pledge matches the canonical
Contributor Covenant phrasing; locate the sentence containing "We as members,
contributors, and leaders pledge to make participation in our community a
harass-free experience for everyone" and update it to use "harassment-free
experience for everyone."

In `@crates/uselesskey-bdd/features/pgp.feature`:
- Around line 119-122: The scenario titled "PGP user ID sanitizes special
characters" conflicts with its assertion — it currently checks that the raw
label "Test!@#User" is preserved via the step 'Then the PGP user ID should
contain "Test!@#User"'; either rename the scenario to e.g. "tolerates special
characters in label" to reflect preservation, or change the Then-step to assert
the expected sanitized user-id value; additionally, add an assertion that the
generated PGP user ID includes the domain suffix (e.g. contains
"@uselesskey.test") or explicitly validate the full address is RFC‑5322
compliant when the label contains "@", so cases like label "Test!@#User" cannot
silently create an invalid local-part.

In `@crates/uselesskey-bdd/tests/bdd.rs`:
- Around line 3862-3869: The "again" step handlers det_corrupt_pgp_armor_again
and det_corrupt_pgp_binary_again currently ignore the variant and do no state
mutation; change them to actually produce and store a second deterministic
corruption in the UselessWorld (e.g., call the same deterministic corruption
helper used elsewhere and save the result into a new field like
pgp_corrupted_armor_second / pgp_corrupted_binary_second or convert
pgp_corrupted_armor/binary into a Vec and push the new value). Also update the
corresponding then-steps corrupted_pgp_armors_identical and
corrupted_pgp_binaries_identical to compare the two stored values from the world
instead of regenerating corruptions inline. Ensure the functions
det_corrupt_pgp_armor_again, det_corrupt_pgp_binary_again,
corrupted_pgp_armors_identical, and corrupted_pgp_binaries_identical reference
the new world fields.

In `@crates/uselesskey-core/src/negative/der.rs`:
- Around line 229-237: Remove the redundant assert_ne! checks in the test
derived_offset_returns_nonzero_for_nonzero_remainder: the existing assert_eq!
calls already verify derived_offset(10, 7) == 7 and derived_offset(3, 5) == 2 so
the subsequent assert_ne!(derived_offset(10, 7), 0) and
assert_ne!(derived_offset(3, 5), 0) should be deleted; optionally add a
complementary test case (e.g., within the same test or a new one) that calls
derived_offset with a selector % len == 0 scenario to assert it returns 0 to
cover the zero-remainder contract.

In `@crates/uselesskey-ecdsa/tests/ecdsa_prop.rs`:
- Around line 92-101: Add ES384 coverage by duplicating the ES256-based property
tests to run with EcdsaSpec::es384(): update kid_is_deterministic to either
parametrize over spec or add a new test (e.g., kid_is_deterministic_es384) that
uses Factory::deterministic(Seed::new(seed)) and calls fx.ecdsa("prop-kid",
EcdsaSpec::es384()) for k1 and k2, asserting k1.kid() == k2.kid(); do the same
for different_labels_produce_different_kids (or add
different_labels_produce_different_kids_es384) to create two keys with different
labels via fx.ecdsa(..., EcdsaSpec::es384()) and assert their kids differ.

In `@crates/uselesskey-interop-tests/src/lib.rs`:
- Line 1: Add the crate-level attribute to forbid unsafe code by inserting
#![forbid(unsafe_code)] at the top of this crate's lib.rs (the crate root
source), ensuring the entire crate and its tests/helpers are compiled with
unsafe code forbidden; place the attribute before any module/item declarations
so it applies crate-wide.

In `@crates/uselesskey-rustls/tests/negative.rs`:
- Around line 47-82: The helper try_handshake currently returns Ok(()) even if
the loop exits due to no progress or reaching MAX_HANDSHAKE_ITERATIONS, which
can silently hide stalled handshakes; update try_handshake to detect a stalled
handshake after the loop (e.g., check client.is_handshaking() or
server.is_handshaking() or whether either side has completed) and return a
distinct Err (or a Result enum variant) describing the stall instead of Ok(()),
so callers can fail tests that unexpectedly never finish; reference the
try_handshake function and the MAX_HANDSHAKE_ITERATIONS loop and use
rustls::Error (or a small custom error) to convey "handshake stalled" when
neither side has completed.

In `@crates/uselesskey-token/src/token.rs`:
- Around line 276-293: Rename the test function random_base62_uses_full_alphabet
to a name that accurately reflects what it asserts (e.g.,
random_base62_contains_lowercase_or_digit or
random_base62_not_limited_to_first_five) and update any references; keep the
body (the assertion checking that the suffix has at least one lowercase or
digit) unchanged and only change the test function identifier to the new,
clearer name.

In `@crates/uselesskey-token/tests/token_prop.rs`:
- Around line 1-2: The module declaration mod testutil is unused in this test
file (testutil::fx() is never called) and should be removed; either delete the
line "mod testutil;" or actually invoke testutil::fx() where needed. Locate the
unused module declaration (mod testutil) at the top of
crates/uselesskey-token/tests/token_prop.rs and either remove it entirely or
replace usages in the proptest cases to call testutil::fx() instead of
constructing Factory::deterministic(Seed::new(seed)) so the module is genuinely
used.

In `@fuzz/fuzz_targets/ecdsa_pkcs8_pem_parse.rs`:
- Line 27: The match arm that computes `how` uses the non-idiomatic
`data.get(0).copied().unwrap_or(0)` which triggers clippy::get_first; replace
that expression with `data.first().copied().unwrap_or(0)` so the `how`
assignment (the `let how = match ...` expression) uses `.first()` instead of
`.get(0)` while preserving the `.copied().unwrap_or(0) % 5` behavior.

In `@xtask/src/main.rs`:
- Around line 125-153: The feature matrix tuple list currently enumerates
combinations like "rsa+jwk" and "ed25519+pgp" but omits "ecdsa+pgp" and
"hmac+jwk"; update the tuple list (the sequence of ("name",
&["--no-default-features", "--features", "..."]) entries) to add entries for
("ecdsa+pgp", &["--no-default-features", "--features", "ecdsa,pgp"]) and
("hmac+jwk", &["--no-default-features", "--features", "hmac,jwk"]) so the matrix
covers those potential interactions.

In `@xtask/src/receipt.rs`:
- Around line 223-238: The test runner_records_coverage_percent currently
asserts the serialized JSON via string containment which is fragile; instead
read the file, parse the JSON (e.g., with serde_json::from_str into a
serde_json::Value or the Receipt struct), and assert that the coverage_percent
field equals Some(82.5) (or 82.5 in the Value). Locate the test function
runner_records_coverage_percent and replace the json.contains(...) assertion
with parsing the file contents and an equality assertion against
receipt.coverage_percent (or value["coverage_percent"].as_f64()) after calling
Runner::new, set_coverage_percent, and runner.write.
- Around line 141-143: The setter set_coverage_percent currently accepts
non-finite f64 values which later cause serde_json::to_string_pretty in write()
to fail with an opaque error; change set_coverage_percent to validate the input
with percent.is_finite() and reject NaN/±Infinity immediately (either by
returning Result<(), E> and returning an Err for non-finite values, or by
mapping invalid values to None and documenting that behavior), update the
signature and all callers accordingly, and ensure the error type/message clearly
indicates "invalid coverage percent: non-finite value" so the root cause is
surfaced before serialization.