fix(security): ignore RUSTSEC-2026-0097 — not vulnerable in our usage

The recurring Cargo Deny failure (05-04, 04-27, 05-11, 05-13) was
RUSTSEC-2026-0097, an unsoundness advisory against rand 0.8.x. The
unsoundness only triggers when ALL of these conditions hold:

  1. log + thread_rng features enabled on rand
  2. A custom log::Log implementation is registered
  3. The custom logger calls rand::rng() / rand::thread_rng() and
     invokes TryRng methods on ThreadRng from inside the logger
  4. ThreadRng reseeds (every ~64 KB) while called from the logger

Verified our codebase does not meet condition (2):

    $ grep -rln "log::Log\|impl Log\|set_logger\|set_boxed_logger" crates/
    (empty)

Our rand usage is straightforward (canary token generation, boundary
nonces, retry jitter, FPR calibration RNG, auth token randomness) —
none inside a logger.

Dependabot PR #197 captured the rand 0.8 → 0.9 migration but the
upgrade is a major version bump with breaking API changes. The
codebase doesn't compile against rand 0.9 without source edits we
don't currently need to make.

Closes the cargo-deny failure surfaced as the recurring Security
Audit red.

Author: epappas

deny.toml

@@ -17,6 +17,15 @@ ignore = [
     # Unmaintained transitive crates (no fixed upgrade available).
     "RUSTSEC-2025-0119", # number_prefix
     "RUSTSEC-2024-0436", # paste
+    # rand 0.8 unsoundness — only triggers when a custom log::Log implementation
+    # calls rand::rng() and a TryRng method on ThreadRng from inside the logger,
+    # AND the ThreadRng reseeds (every 64 KB) while called from the logger.
+    # We verified our codebase has zero `impl log::Log` implementations
+    # (grep -rln "log::Log\|impl Log\|set_logger" crates/ returns empty), so
+    # the precondition cannot be met. The fix (rand 0.9) is a major bump with
+    # breaking API changes — Dependabot PR #197 captured the migration but
+    # the API surface needs source edits we don't currently need.
+    "RUSTSEC-2026-0097", # rand 0.8 — n/a, no custom logger; see #197
 ]
 
 # =============================================================================