ci(security): commit Cargo.lock and add the osv-scanner job

.cargo/audit.toml

@@ -8,4 +8,8 @@
 ignore = [
     # paste unmaintained — transitive via tokenizers/spm_precompiled
     "RUSTSEC-2024-0436",
+    # name collision — `cache` here is this workspace's crates/cache path dependency, not the abandoned crates.io crate
+    "RUSTSEC-2020-0128",
+    # name collision — `cache` here is this workspace's crates/cache path dependency, not the abandoned crates.io crate
+    "RUSTSEC-2021-0006",
 ]

.github/workflows/security.yml

@@ -57,3 +57,17 @@ jobs:
         run: cargo install cargo-audit --locked --version ^0.22
       - name: cargo audit
         run: cargo audit --deny unmaintained --deny unsound --deny yanked
+
+  # WHY the reusable workflow rather than the scanner action: the action's own
+  # description recommends it, and warns the action's behaviour may change in a
+  # minor patch update. This repo can use it now that Cargo.lock is committed --
+  # the scan-args reference a lockfile that must exist on disk after checkout.
+  osv-scanner:
+    name: osv scanner
+    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@9a498708959aeaef5ef730655706c5a1df1edbc2
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    with:
+      scan-args: '--config=osv-scanner.toml --lockfile=Cargo.lock'

.gitignore

@@ -3,7 +3,13 @@
 **/*.rs.bk
 
 # Cargo
-Cargo.lock
+#
+# WHY Cargo.lock IS committed here: it was ignored by inheritance rather than by
+# decision -- the line arrived in the initial public snapshot with no stated
+# reason, while every other Rust workspace in the fleet commits its lockfile.
+# Committing it makes `--locked` builds reproducible and gives the OSV scanner
+# something to scan; without it that job finds no lockfile and fails on every
+# run rather than reporting anything.
 
 # Editor / OS cruft
 .DS_Store