ci(workflow): gate the build on cargo audit

.github/workflows/ci.yaml

@@ -46,3 +46,50 @@ jobs:
       - uses: Swatinem/rust-cache@v2
       - name: Run tests
         run: cargo test --workspace
+
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - name: Install cargo-audit
+        run: cargo install cargo-audit --locked
+      # Blocking on any advisory not listed below — a newly introduced
+      # vulnerability fails this job. Every `--ignore` is a pre-existing
+      # transitive-dependency advisory tolerated today because the fix is a
+      # dependency version bump, and version bumps for the published
+      # `rustmotion` crate are being handled separately from this workstream
+      # (crates/rustmotion/Cargo.toml, orchestrator-owned). Unmaintained/
+      # unsound/yanked advisories (17 as of 2026-09-22) print but do not fail
+      # the job — that's `cargo audit`'s own default, left unchanged here.
+      #
+      # Review by 2026-12-22, or sooner once the dependency bumps land:
+      #   RUSTSEC-2025-0008 — openh264-sys2 0.6.6, heap overflow in decoding.
+      #     Direct dependency of the published `rustmotion` crate. Fix: openh264 >=0.8.0.
+      #   RUSTSEC-2026-0204 — crossbeam-epoch 0.9.18, invalid pointer deref in `fmt::Pointer`.
+      #     Via rayon-core <- exr <- image, reaches rustmotion-core/-components. Fix: >=0.9.20.
+      #   RUSTSEC-2026-0195, RUSTSEC-2026-0194 — quick-xml 0.38.4 / 0.39.4, DoS + quadratic runtime.
+      #     0.38.4 via syntect reaches the published crates; 0.39.4 via dioxus-desktop/rfd is
+      #     rustmotion-studio-only (Linux/Wayland file dialogs). Fix: >=0.41.0.
+      #   RUSTSEC-2026-0285 — rustls 0.23.37, TLS 1.3 handshake level-boundary bug.
+      #     Via ureq, used by rustmotion/rustmotion-core for Google Fonts + Iconify fetches. Fix: >=0.23.45.
+      #   RUSTSEC-2026-0104, RUSTSEC-2026-0098, RUSTSEC-2026-0099, RUSTSEC-2026-0049 — rustls-webpki
+      #     0.103.9, four CRL/name-constraint parsing bugs. Same ureq path as rustls above.
+      #     Fix: >=0.103.13,<0.104.0-alpha.1 (or the matching 0.104 alpha per advisory).
+      #   RUSTSEC-2026-0257 — webbrowser 1.2.1, BROWSER env argument injection on Unix.
+      #     Via dioxus-desktop, rustmotion-studio only (`publish = false`, never reaches a published
+      #     crate). Fix: >=1.2.2.
+      - name: Audit dependencies
+        run: >
+          cargo audit
+          --ignore RUSTSEC-2025-0008
+          --ignore RUSTSEC-2026-0204
+          --ignore RUSTSEC-2026-0195
+          --ignore RUSTSEC-2026-0194
+          --ignore RUSTSEC-2026-0285
+          --ignore RUSTSEC-2026-0104
+          --ignore RUSTSEC-2026-0098
+          --ignore RUSTSEC-2026-0099
+          --ignore RUSTSEC-2026-0049
+          --ignore RUSTSEC-2026-0257