rust-supply-chainlisted

# Rust Supply Chain An audit that ends in a list of advisory IDs has done the easy half. The hard half is saying, per advisory, whether this repo actually reaches the vulnerable code path and what to do about it. ## What this covers, and the one rule Four questions: is anything we depend on known-vulnerable, is anything unmaintained, does every licence in the tree comply with the policy, and is the tree carrying weight it does not need. Read `Cargo.lock` as the authority on what is actually built — not `Cargo.toml`, which states ranges — and read the MSRV from `docs/agents/rust.md`, because a fix that bumps a dependency past the MSRV is not a fix. The rule: **every finding ends in a decision** — upgrade, replace, vendor, or accept with a written reason and an expiry. An unactioned advisory list is noise, and noise trains people to ignore the tool. ## Two tools, overlapping on purpose `cargo audit` reads the RustSec advisory database and answers exactly one question: is anything in the tree known-vulnerable. `cargo deny` answers four — `advisories`, `bans`, `licenses`, `sources` — including that same one, against a policy file; with no deny.toml it runs on built-in defaults that encode no policy. A repo running `cargo deny check` does not need `cargo audit` separately; a repo that wants only advisory checking and no policy file is better off with `cargo audit` alone. Say which the repo should run and why, rather than adding both. The policy file in full, annotated, is in