PCH-02 Fix Drafts

Drafts for all 10 findings of peach-code-review.md (Fable 5, 2026-06-12): 1 Low (PCH-02-001), 9 Informational. Drafted against v4.0.0, dev lane, baseline 117 test files / 3474 tests green, tsc --noEmit clean.

Nothing outside src/drafts/PCH-02-FIXES/ was modified. Both gates exclude this folder (tsconfig.json excludes src/drafts; vitest.config.ts excludes src/drafts/**), so the drafts are inert until integrated.

Every *.patch.md carries exact before/after code anchored to the cited file:line, the rationale, compatibility verification, and its integration save message. Every *.test.ts is written with destination-form imports and a DESTINATION: header — copy to the stated path, no rewrite needed.

Finding	Severity	Draft	Kind
PCH-02-001 update-entry sanitizers	Low	PCH-02-001-vault-patch-sanitizers.patch.md + vault.update-entry-sanitize.test.ts	code + 8 tests
PCH-02-003 SAS trust model	Info	PCH-02-003-sas-trust-model-comment.patch.md	doc only
PCH-02-004 exact-pin deps	Info	PCH-02-004-exact-pin-deps.patch.md + WASM-PROVENANCE.md	manifest of pins + new doc
PCH-02-005 legacy PBKDF2	Info	PCH-02-005-legacy-pbkdf2-doc.patch.md	doc + small UI notice
PCH-02-007 HIBP padding	Info	PCH-02-007-hibp-add-padding.patch.md + vault.hibp-padding.test.ts	code + 3 tests
PCH-02-008 BinaryReader bounds	Info	PCH-02-008-binaryreader-bounds.patch.md + peachPayload.binaryreader-bounds.test.ts	code + 8 tests
PCH-02-010 clipboard hash match	Info	PCH-02-010-clipboard-hash-match.patch.md + clipboard.hash-match.test.ts	decision: Option A (doc) recommended / Option B (code + 4 tests + ⚠ permission)

Integration sequencing, decisions, and the full contract: INTEGRATION-CONTRACT.md.