build: bump toolchain to v4.33.0 past kernel soundness fix (#14576)

[morluto]

Fixes #9

Problem

lean-toolchain pins v4.33.0-rc1, tagged 2026-07-15 — 13 days before the kernel soundness fix for leanprover/lean4#14576 (PR #14577, merged 2026-07-28, shipped in stable v4.33.0 on 2026-08-10). The affected kernel accepts malformed nested-inductive declarations via checked addDecl and an axiom-free proof of False (oss-security advisory).

An audit of this repository found no exploit path (the raw-declaration emitters only produce .defnDecl/.thmDecl of nat literals / RArray trees / reflBoolTrue; no .inductDecl, no Expr.proj, no unsafe/native_decide), but a formal-verification project should not ship on a kernel with a known soundness hole: only a clean rebuild under the fixed kernel turns "compiles" back into "verified".

Changes

File	Change
lean-toolchain	v4.33.0-rc1 → v4.33.0
lakefile.toml	mathlib pin → db584cd6d46c92f209a44c0f1c829460d327499d (first stable-toolchain window, 2026-08-10); moved after the PNT+ require so Mathlib's transitive pins take precedence
lakefile.toml	PrimeNumberTheoremAnd pinned to fork rev 674f3b8 (see below)
lake-manifest.json	regenerated via lake update; transitive deps now match mathlib@db584cd6

PrimeNumberTheoremAnd fork pointer

Building against mathlib@db584cd6 exposed one incompatibility in the dependency (not this repo): MediumPNT.lean:2455 has a trailing rfl that newer Mathlib simp renders redundant ("No goals to be solved"), and PrimeGapsTheory.NumberTheory.PNT imports that module.

This PR temporarily points the require at morluto/PrimeNumberTheoremAnd@674f3b8 = upstream 2667e41 + deletion of that single rfl. Once an equivalent fix lands on AxiomMath/PrimeNumberTheoremAnd, the URL can be swapped back and pinned to that sha (happy to open that one-liner as a PR there if useful).

Validation

Full clean rebuild from source under the fixed kernel:

lake build   # defaultTargets: PrimeGapsCert + PrimeGapsTheory + PrimeGaps
Build completed successfully (4295 jobs).

This includes both numerical certificates (k50e25d25n1295.json → 138+172 stored-row kernel checks; k105d20n15.json) and every decide +kernel obligation re-checked by the v4.33.0 kernel. Mathlib consumed from cloud cache for db584cd6; all project modules compiled locally.

Follow-ups (not in this PR)

Per issue #9: enabling leanchecker/nanoda lanes and running the Comparator configs in CI are separate hardening steps; happy to propose them next.