[gorzell]

Adds a RustSec audit workflow for rust-gems. This also checks in a root Cargo.lock, updates .gitignore for lockfile auditing, and passes --locked in the Makefile build target.

[Copilot]

🟡 Changes recommended

CI does not enforce lockfile consistency, so builds can use a different dependency graph than both audit jobs scan, potentially missing vulnerabilities in built dependencies.

1 open issue

• CI audits a stale lockfile while builds may resolve different dependencies · New

What changed in this PR

Aligns rust-gems’ RustSec auditing with the Blackbird workflow approach and adds a tracked dependency lockfile for workspace audits.

Changes:

• Adds push-triggered and manual audits, plus nightly audits with issue-reporting permissions.
• Commits the root Cargo.lock as the audit input.
• Allows tracking the root lockfile while keeping nested lockfiles ignored.

File	Description
Cargo.lock	Records workspace dependency versions for auditing.
.gitignore	Exempts the root lockfile from ignore rules.
.github/​workflows/​security-audit.yml	Adds event-driven and scheduled RustSec audit jobs.

_{Review effort: Balanced (auto)}

[tclem]

Source review found no new actionable issues. Local validation was blocked.

  _{Generated via Copilot (GPT-6.1 Sol) on behalf of @tclem}