feat(security): release v0.7.0 with comprehensive security hardening (S-01 to S-11)

tests/carrier_model_a_test.rs

@@ -8,7 +8,7 @@ use rand::RngCore;
 
 use sanctum::crypto::{
     derive_kek, generate_dek, generate_salt, wrap_slot0_payload,
-    wrap_slot1_payload, KdfParams, CHUNK_SIZE,
+    wrap_slot1_payload, KdfParams, CHUNK_SIZE, MIN_MEMORY_COST_KIB, MIN_TIME_COST,
 };
 use sanctum::storage::Database;
 use sanctum::verify::verify_container;
@@ -31,8 +31,8 @@ async fn test_model_a_carrier_filesystem_and_accounting_attack_resistance() {
     let pass_hidden = "SuperSecretHiddenPassword2026!";
 
     let kdf_params = KdfParams {
-        memory_cost: 1024,
-        time_cost: 1,
+        memory_cost: MIN_MEMORY_COST_KIB,
+        time_cost: MIN_TIME_COST,
         parallelism: 1,
     };
 
@@ -270,8 +270,8 @@ async fn test_model_a_container_file_size_invariance() {
     let pass_hidden = "HiddenPass2026!";
 
     let kdf_params = KdfParams {
-        memory_cost: 1024,
-        time_cost: 1,
+        memory_cost: MIN_MEMORY_COST_KIB,
+        time_cost: MIN_TIME_COST,
         parallelism: 1,
     };
 
@@ -369,8 +369,8 @@ async fn test_carrier_file_drop_and_append_mode() {
     let pass_hidden = "HiddenSecretPassword2026!";
 
     let kdf_params = KdfParams {
-        memory_cost: 1024,
-        time_cost: 1,
+        memory_cost: MIN_MEMORY_COST_KIB,
+        time_cost: MIN_TIME_COST,
         parallelism: 1,
     };