ci(audit): ignore unmaintained transitive advisories (#316/#317/#318)

[intendednull]

Why

Three RUSTSEC unmaintained advisories trip CI audit gate. All transitive, no path from our code:

• RUSTSEC-2024-0436 — paste 1.0.15 archived Oct 2024 ([DEP-08] Unmaintained paste 1.0.15 (RUSTSEC-2024-0436) — not in CI ignore list #316)
• RUSTSEC-2024-0370 — proc-macro-error 0.4.12 unmaintained, drags syn 1.x ([DEP-09] Unmaintained proc-macro-error 0.4.12 (RUSTSEC-2024-0370) — not in CI ignore list #317)
• RUSTSEC-2023-0089 — atomic-polyfill 1.0.3 replaced by portable-atomic ([DEP-10] Unmaintained atomic-polyfill 1.0.3 (RUSTSEC-2023-0089) — not in CI ignore list #318)

Upstream chains:

paste 1.0.15
  - leptos 0.7.8 (tachys, leptos_dom, leptos_server, reactive_stores, either_of)
  - iroh 0.98.1 (netwatch -> netlink-packet-core)

proc-macro-error 0.4.12
  - iroh-blobs 0.100.0 -> bao-tree -> genawaiter -> genawaiter-proc-macro

atomic-polyfill 1.0.3
  - iroh 0.98.1 (postcard -> heapless), iroh-blobs, iroh-gossip, iroh-relay, irpc

No trivial single-dep bump fixes any of these — iroh + leptos ecosystems both pin upstreams that haven't migrated. Bumping iroh/leptos = deep risk, separate work.

Fix

Add --ignore RUSTSEC-XXXX-XXXX to existing cargo audit step in .github/workflows/ci.yml. Matches existing style (inline # comment with tracking issue ref). Issues #316/#317/#318 stay open as tracking issues — not closed by this PR — until upstream fixes land or we bump iroh/leptos.

Verify

Local before:

warning: 3 allowed warnings found
  paste            RUSTSEC-2024-0436
  proc-macro-error RUSTSEC-2024-0370
  atomic-polyfill  RUSTSEC-2023-0089

Local after (same flags as CI):

Scanning Cargo.lock for vulnerabilities (639 crate dependencies)
exit 0

Tradeoff: ignoring vs upgrading. Upgrading rejected — iroh/leptos pin transitives, blast radius too large for this scope. Tracking issues capture follow-up.

Refs #316
Refs #317
Refs #318

---

Generated by Claude Code