Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@README.md`:
- Around line 134-140: Update the README entry for noir_rsa to explicitly state
that the dependency table lists the active circuit/runtime dependency versions
(e.g., noir_rsa 0.10.0) and that vendored snapshots may be independently pinned
and differ (e.g., the vendored noir_rsa v0.9.1 noted in VENDORED_FROM.md); add a
short parenthetical or footnote near the noir_rsa row clarifying "table = active
dependencies; vendored copies may show older pinned versions (see
VENDORED_FROM.md)".

In `@selective_disclosure/src/main.nr`:
- Around line 223-228: Cast disclosed_location_flags from Field to a small
unsigned integer (e.g., u8) and constrain it to 2 bits before doing bitwise ops:
convert disclosed_location_flags to an integer variable (flags_u8), assert
flags_u8 < 4 to constrain to 2 bits, compute disclosed_lat_neg = flags_u8 & 1
and disclosed_lon_neg = (flags_u8 >> 1) & 1, then compare those with
exact_lat_is_negative and exact_lon_is_negative via the existing assert calls;
use the same variable names (disclosed_location_flags, disclosed_lat_neg,
disclosed_lon_neg, exact_lat_is_negative, exact_lon_is_negative) so the logic is
identical but uses integer bitwise operators.

---

Nitpick comments:
In `@vendor/noir-rsa/VENDORED_FROM.md`:
- Around line 3-6: The VENDORED_FROM.md entry for noir-rsa currently lists
Source, Version, License, and Authors but lacks the exact upstream commit SHA;
update the file by adding an explicit "Commit" (or "Upstream commit") field
containing the full commit hash corresponding to the vendored code (alongside
the existing Source and Version lines) so audits are reproducible; ensure the
new line follows the same markdown bullet style and references the exact commit
for the tag/version noted.