Add zeroize dependency and use it to clear intermediate buffers
and hex-encoded signing key strings in execute_deploy and
execute_maintain to prevent sensitive material from lingering
in memory.

- Add zeroize = "1" to util/toolkit/Cargo.toml
- Import zeroize::Zeroize in toolkit_js/mod.rs
- Add zeroize_string helper for heap-allocated Strings
- Zeroize raw signing key bytes after hex encoding in deploy
- Zeroize hex signing key after toolkit-js execution in deploy
- Zeroize new_authority hex after toolkit-js execution in maintain

Refs: #53
Signed-off-by: Mike Clay <mike.clay@shielded.io>
Made-with: Cursor

…eploy/maintain

PM-22038 inadvertently reverted the PM-22034 zeroization fix when this file
was re-touched. The Vec<u8> from serialize_untagged(...signing_key()) and
the hex String it's encoded into are not covered by WalletSeed's
ZeroizeOnDrop, so they need explicit zeroization on both success and error
paths.

Refs: PM-22034, #53
Signed-off-by: Mike Clay <mike.clay@shielded.io>

… buffers (midnightntwrk#1379)

* Add change file for incomplete zeroization buffers fix

Issue: midnightntwrk/midnight-security#53
Signed-off-by: Mike Clay <mike.clay@shielded.io>
Made-with: Cursor

* fix(toolkit): zeroize signing key buffers after use

Add zeroize dependency and use it to clear intermediate buffers
and hex-encoded signing key strings in execute_deploy and
execute_maintain to prevent sensitive material from lingering
in memory.

- Add zeroize = "1" to util/toolkit/Cargo.toml
- Import zeroize::Zeroize in toolkit_js/mod.rs
- Add zeroize_string helper for heap-allocated Strings
- Zeroize raw signing key bytes after hex encoding in deploy
- Zeroize hex signing key after toolkit-js execution in deploy
- Zeroize new_authority hex after toolkit-js execution in maintain

Refs: midnightntwrk#53
Signed-off-by: Mike Clay <mike.clay@shielded.io>
Made-with: Cursor

* fix(toolkit): remove custom unsafe zeroize helper, fix error-path zeroization

- Replace custom zeroize_string helper with direct String::zeroize() from the zeroize crate, eliminating local unsafe.

- Fix error-path zeroization gap by zeroizing strings before propagating execute_js errors via ? operator.

Signed-off-by: Mike Clay <mike.clay@shielded.io>
Made-with: Cursor

* docs: add PR link to changes file

Signed-off-by: Mike Clay <mike.clay@shielded.io>
Made-with: Cursor

* chore(toolkit): promote zeroize to workspace dependency

---------

Signed-off-by: Mike Clay <mike.clay@shielded.io>

…idnightntwrk#1217)

* fix: harden WalletSeed, Keypair, and address code quality (PM-22038)

Address Least Authority audit Suggestion 3 (A2):

- WalletSeed: remove Copy (required for ZeroizeOnDrop), add
  Zeroize+ZeroizeOnDrop, implement redacted Debug that prints
  WalletSeed::<variant>(***) instead of raw bytes. Keep Clone
  (needed for HashMap dual-ownership pattern) and Hash/PartialEq/Eq
  (required for HashMap<WalletSeed, Wallet<D>> key).

- Keypair: remove Clone (zero callers — pure parsing wrapper).

- MaintenanceUpdateBuilder::add_addresses: accept &[MaintenanceCounter]
  and use zip iterator instead of unchecked index loop, eliminating
  potential index out-of-bounds panic.

- WalletSeed::try_from_lazy_hex: pre-validate hex string length
  (max 128 hex chars) before calling hex::decode, preventing memory
  allocation from oversized untrusted input.

- Fix all Copy-removal compilation errors across ledger/helpers and
  util/toolkit by adding explicit .clone() at ownership transfer points.

- Add unit tests for redacted Debug output, hex length validation,
  zip truncation safety, and HashMap key compatibility.

Made-with: Cursor

Signed-off-by: Mike Clay <mike.clay@shielded.io>

* fix: add explicit Clone calls where WalletSeed lost Copy trait

WalletSeed no longer derives Copy (removed for security hardening).
Two test helpers and one genesis utility need explicit .clone() to
construct owned values from borrows.

Made-with: Cursor

Signed-off-by: Mike Clay <mike.clay@shielded.io>

* fix: add Clone calls for WalletSeed in e2e tests and fix formatting

Add explicit .clone() on WalletSeed in e2e tests and format
merge-resolved files to satisfy CI cargo fmt check.

Made-with: Cursor

Signed-off-by: Mike Clay <mike.clay@shielded.io>

* fix: remaining Clone calls and cargo fmt formatting

Add .clone() for WalletSeed in transaction, utxo_spend, dust_balance,
generate_intent, show_wallet, and contract_maintenance. Apply cargo fmt.

Made-with: Cursor

Signed-off-by: Mike Clay <mike.clay@shielded.io>

* chore: add change file for PM-22038 (PR midnightntwrk#1217)

Made-with: Cursor

Signed-off-by: Mike Clay <mike.clay@shielded.io>

* fix: add GitHub issue reference to changes file

Signed-off-by: Mike Clay <mike.clay@shielded.io>

* fix: add missing .clone() for WalletSeed after Copy removal

Made-with: Cursor

Signed-off-by: Mike Clay <mike.clay@shielded.io>

* fix(toolkit): restore zeroization of signing-key buffers in execute_deploy/maintain

PM-22038 inadvertently reverted the PM-22034 zeroization fix when this file
was re-touched. The Vec<u8> from serialize_untagged(...signing_key()) and
the hex String it's encoded into are not covered by WalletSeed's
ZeroizeOnDrop, so they need explicit zeroization on both success and error
paths.

Refs: PM-22034, midnightntwrk#53
Signed-off-by: Mike Clay <mike.clay@shielded.io>

* chore: update Cargo.lock for toolkit zeroize dep

Signed-off-by: Mike Clay <mike.clay@shielded.io>

---------

Signed-off-by: Mike Clay <mike.clay@shielded.io>