Summary

• Replace bincode 1.x (RUSTSEC-2025-0141, permanently unmaintained) with postcard 1.x in mlxcel-core's lang_analyzer disk cache
• Remove the corresponding [advisories.ignore] entry from deny.toml now that bincode is gone from the dep tree

Architectural decision

postcard 1.x was chosen over the other alternatives (bitcode, rkyv, bincode 2.x) for these reasons:

• 1.0+ stable with frozen wire format: production users' on-disk caches are safe across future dependency upgrades; bitcode is pre-1.0 and has changed wire formats between minor versions
• Drop-in serde API: postcard::to_allocvec(&v)? / postcard::from_bytes::<T>(&bytes)? — minimal change to the 3 call sites in one file
• Embedded ecosystem standard: natural fit for an inference runtime crate; actively maintained
• Use case is not performance-critical (one startup read, KB-scale cache file), so bitcode's speed/size advantages do not apply here

Cache format compatibility

mlxcel-core's corrupt-detection path in lang_analyzer/cache.rs renames any file that fails deserialization to *.broken.<epoch>.bak before rebuilding from the tokenizer source. Production users with old bincode-format caches will gracefully degrade on upgrade — the postcard from_bytes call will fail, the corrupt-detection path fires, and the cache is rebuilt automatically. No explicit migration code is needed.

What changed

• src/lib/mlxcel-core/Cargo.toml: bincode = "1" → postcard = { version = "1", features = ["alloc"] }
• src/lib/mlxcel-core/src/lang_analyzer/cache.rs: bincode::deserialize → postcard::from_bytes, bincode::serialize → postcard::to_allocvec, doc comments updated
• src/lib/mlxcel-core/src/lang_analyzer/mod.rs: Bincode(#[from] bincode::Error) → Postcard(#[from] postcard::Error), module doc updated
• deny.toml: removed RUSTSEC-2025-0141 ignore entry; paste entry retained

Verification

• cargo check --lib -p mlxcel-core --no-default-features — passes cleanly
• cargo tree -p mlxcel-core -i bincode — returns "package not found" (bincode fully removed)
• cargo deny check — passes with advisories ok and RUSTSEC-2025-0141 no longer ignored

Closes #8