fix(security): clear fuzz lockfile advisories and close the audit gap

.github/dependabot.yml

@@ -39,6 +39,22 @@ updates:
           - "version-update:semver-major"
           - "version-update:semver-minor"
 
+  # Fuzz targets are a separate cargo workspace with their own lockfile, so the
+  # "/" entry above never touches them. Without this the fuzz lockfile silently
+  # rots between releases (it drifted onto an unsound `anyhow` and two yanked
+  # crates before CI started auditing it). Grouped into one PR — these are
+  # build-time-only test dependencies, not shipped library code.
+  - package-ecosystem: "cargo"
+    directory: "/crates/bashkit/fuzz"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      fuzz-dependencies:
+        patterns:
+          - "*"
+
   # GitHub Actions
   - package-ecosystem: "github-actions"
     directory: "/"

.github/workflows/ci.yml

@@ -147,7 +147,13 @@ jobs:
         # upgrade to, and the crate is reachable only through the opt-in `ssh`
         # feature. Drop this flag once `rsa` ships a constant-time release.
         # Keep in sync with the `[advisories] ignore` list in deny.toml.
-        run: cargo audit --ignore RUSTSEC-2023-0071
+        #
+        # `crates/bashkit/fuzz` is a separate workspace with its own lockfile, so
+        # the workspace scan above never reaches it. Audit it explicitly —
+        # otherwise fuzz-only dependencies rot unnoticed between releases.
+        run: |
+          cargo audit --ignore RUSTSEC-2023-0071
+          cargo audit --ignore RUSTSEC-2023-0071 -f crates/bashkit/fuzz/Cargo.lock
 
       - name: License check (cargo-deny)
         # Held at v2.0.20: v2.1.0 (6f99e34) bundles cargo-deny 0.20.2, whose