[Jaro-c]

Closes #2034

The scheduled audit on main went red on 2026-10-12 and nothing said so. I fix the cause and the silence.

• RUSTSEC-2024-0449 (unsafe-libyaml 0.2.11 unmaintained, via serde_yaml_ng 0.10.0, the latest release) is accepted explicitly, with the reason written down, in deny.toml and in a new .cargo/audit.toml. Both are needed: cargo-deny reads the first, cargo-audit reads the second, and release.yml runs cargo audit --deny warnings from the root, so an entry only in deny.toml would have failed the next release. tests/audit_ignore_lists.rs keeps the two lists equal; its parser ignores commented-out lines and reads both forms cargo-deny accepts (table and plain string). Moving off the crate is deps: move the compose parser off unsafe-libyaml (RUSTSEC-2024-0449) #2035, which removes both entries.
• audit.yml runs daily instead of weekly. The schedule audits main and then starts a separate run of the same workflow on develop (gh workflow run audit.yml --ref develop), so each branch is audited in its own context. The scheduled job waits for that run and fails if it does not succeed or never appears, so a develop run cancelled in the queue is reported too. Checking develop out from main's scheduled run would execute develop's tree where every step can write the cache all branches read; CodeQL flagged exactly that on the first version of this pull request, and skipping the cache step did not clear it, because any step there can write the cache.
• A new report job opens an issue when the scheduled run, for either branch, does not succeed (failure, cancelled or timed out), and when a manual dispatch fails; if the issue is already open it comments instead. The develop run started by the schedule does not report itself, and reporters run one at a time, so one failure gives one issue. issues: write is granted to that job only; it checks out nothing, installs nothing, and reads every value from env.
• freshness-audit stays at 15 days for now. Lowering it to 3 here turned it red at once, because the last green scheduled run is 2026-10-05 and today's failed on this advisory. I lower it once the daily runs are green.
• .cargo/audit.toml joins the paths that run the audit on a pull request.

What I ran:

• cargo audit --deny warnings and cargo deny check from the root: exit 0. Removing the id from either file turns its tool red on RUSTSEC-2024-0449 and fails the_two_ignore_lists_agree_on_advisory_ids.
• The report script, extracted from the workflow, against a stub gh: it comments on the open issue's number, creates one with the labels when none is open, reports a cancelled run and a failed dispatch, and exits 1 when gh fails. The dispatch-and-wait step against a stub gh: exit 0 when the run appears and passes, 1 when it fails, 1 when it never appears. Commenting out the ignore in .cargo/audit.toml, or adding a plain-string id to deny.toml, fails the agreement test.
• actionlint 1.7.12 on the three workflows; cargo test --locked --all-features --workspace: 3423 passed, 0 failed; the lint-shell suite as test-command runs it: 38/38; check-merge-group-triggers.py and check-caller-with-defaults.py: clean.

None of the audit checks is required, so this changes no required check name.

Signed-off-by: Jaro-c 75870284+Jaro-c@users.noreply.github.com