chore: resolve RustSec advisory sweep breaking security gate (#208)

RUSTSEC-2026-0204 (crossbeam-epoch 0.9.18, invalid pointer deref in
fmt::Pointer): real fix available — cargo update to 0.9.20. Dev-only
chain via criterion -> rayon.

RUSTSEC-2026-0194 / RUSTSEC-2026-0195 (quick-xml 0.26.0 DoS): no fix
reachable — pinned by pprof 0.15 -> inferno 0.11, and pprof (latest)
cannot take inferno 0.12. Dev-only profiling stack, never shipped in
the wheel, so ignore in both cargo-deny and audit-check with removal
condition documented (pprof release with inferno >= 0.12).

These advisories landed in the RustSec DB after 0.11.1 and fail every
fresh CI run regardless of diff (first seen on #206).

Author: 27Bslash6

.github/workflows/security-fast.yml

@@ -32,6 +32,9 @@ jobs:
     - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
+        # quick-xml DoS advisories: dev-only via pprof->inferno, no upgrade path.
+        # Keep in sync with deny.toml [advisories].ignore.
+        ignore: RUSTSEC-2026-0194,RUSTSEC-2026-0195
 
   cargo-deny:
     name: License & Supply Chain

Cargo.lock

@@ -24,8 +24,15 @@ all-features = true
 # Check all workspace crates for unmaintained dependencies
 unmaintained = "workspace"
 
-# No initial exemptions - all vulnerabilities must be addressed
-ignore = []
+# Exemptions require a reason and are re-checked whenever the parent dep updates.
+# quick-xml 0.26 is pinned by pprof 0.15 -> inferno 0.11 (dev-only profiling/flamegraph
+# stack, never shipped in the wheel). No patched quick-xml exists on the 0.26 line and
+# pprof 0.15 (latest) cannot take inferno 0.12. Remove when pprof releases with inferno >= 0.12.
+# Keep in sync with the audit-check ignore list in .github/workflows/security-fast.yml.
+ignore = [
+    { id = "RUSTSEC-2026-0194", reason = "quick-xml DoS (quadratic attr check); dev-only via pprof->inferno, no upgrade path yet" },
+    { id = "RUSTSEC-2026-0195", reason = "quick-xml DoS (unbounded ns alloc); dev-only via pprof->inferno, no upgrade path yet" },
+]
 
 # ═══════════════════════════════════════════════════════════════
 # LICENSES - License Policy Enforcement