updates from main and ci

.deny.toml

@@ -16,7 +16,6 @@ ignore = [
   { id = "RUSTSEC-2026-0097", reason = "`rand` v0.8.5 is present transitively from logos crates, modification may break integration" },
   { id = "RUSTSEC-2026-0118", reason = "`hickory-proto` v0.25.0-alpha.5 is present transitively from logos crates, modification may break integration" },
   { id = "RUSTSEC-2026-0119", reason = "`hickory-proto` v0.25.0-alpha.5 is present transitively from logos crates, modification may break integration" },
-  { id = "RUSTSEC-2026-0145", reason = "`astral-tokio-tar` v0.6.1 is pulled transitively via testcontainers (integration_tests dev/test path); waiting on upstream fix" },
 ]
 yanked = "deny"
 unused-ignored-advisory = "deny"

nssa/src/validated_state_diff.rs

@@ -523,7 +523,6 @@ mod tests {
         use nssa_core::{
             Commitment, InputAccountIdentity, SharedSecretKey,
             account::{Account, AccountWithMetadata},
-            encryption::EphemeralPublicKey,
         };
 
         use crate::{
@@ -550,9 +549,7 @@ mod tests {
         // Attacker controls a private account.
         let attacker_keys = test_private_account_keys_1();
         let attacker_id = AccountId::for_regular_private_account(&attacker_keys.npk(), 0);
-        let attacker_esk = [12_u8; 32];
-        let attacker_ssk = SharedSecretKey::new(attacker_esk, &attacker_keys.vpk());
-        let attacker_epk = EphemeralPublicKey::from_scalar(attacker_esk);
+        let (attacker_ssk, attacker_epk) = SharedSecretKey::encapsulate(&attacker_keys.vpk());
 
         let victim_id = AccountId::new([20_u8; 32]);
         let recipient_id = AccountId::new([42_u8; 32]);
@@ -674,7 +671,6 @@ mod tests {
         use nssa_core::{
             Commitment, InputAccountIdentity, SharedSecretKey,
             account::{Account, AccountWithMetadata},
-            encryption::EphemeralPublicKey,
         };
 
         use crate::{
@@ -704,9 +700,7 @@ mod tests {
         // Attacker controls a private account.
         let attacker_keys = test_private_account_keys_1();
         let attacker_id = AccountId::for_regular_private_account(&attacker_keys.npk(), 0);
-        let attacker_esk = [12_u8; 32];
-        let attacker_ssk = SharedSecretKey::new(attacker_esk, &attacker_keys.vpk());
-        let attacker_epk = EphemeralPublicKey::from_scalar(attacker_esk);
+        let (attacker_ssk, attacker_epk) = SharedSecretKey::encapsulate(&attacker_keys.vpk());
 
         // Victim is a private account — not registered in public chain state.
         let victim_keys = test_private_account_keys_2();