Supply Chain & Release Hygiene

The project uses three complementary supply-chain tools:

• cargo audit — vulnerability advisories from RustSec
• cargo deny — license, duplicate, and source policy
• cargo vet — explicit audit chain for every dependency

All three run in CI on every push and every dependabot PR. Treat their output as load-bearing — a real cargo audit failure is a security advisory and warrants a patch release; a cargo vet failure usually means an audit chain needs re-stitching after a version change.

When bumping our own version