fix(security): RUSTSEC-2026-0273 (manzana stubbed crypto) reds ci/security on every open PR

[noahgift]

Same signature as #2805: all PRs red, nothing changed in-repo. The advisory was committed to the RustSec DB at 2026-09-01T07:50:30Z — two seconds after crates.io yanked manzana at 07:50:28Z. ci / security passed on #2825 at 06:44Z and has failed on #2836/#2837/#2838 from 09:56Z. An advisory-DB catch-up, not a regression.

Reachability: zero, measured

cargo tree -p aprender-gpu                  | grep -c manzana -> 0
cargo tree -p aprender-gpu --features metal | grep -c manzana -> 0
cargo tree --workspace                      | grep -c manzana -> 0
git grep -l 'secure_enclave|SecureEnclave' -- '*.rs'          -> 0 files

The middle line is the load-bearing one: manzana is both optional and declared under [target.'cfg(target_os = "macos")'.dependencies], so enabling metal on Linux pulls in nothing. aprender's only three call sites are manzana::metal::*, all behind cfg(all(target_os = "macos", feature = "metal")). The advisory is about secure_enclave::SecureEnclaveSigner, which this workspace never names.

As with the h2 entry above it, cargo deny check advisories passes without an exemption (it walks the activated graph); cargo-audit scans Cargo.lock, which lists target- and feature-gated deps unconditionally. So the ignore goes in .cargo/audit.toml only — adding it to deny.toml would be a dead exemption and fail check_deny_exemptions_live.sh.

Why an ignore and not an upgrade

Both published versions (0.1.0, 0.2.0) are yanked — crates.io reports max_version: 0.0.0, so there is nothing to bump to. More importantly the advisory carries:

[versions]
patched = []

No version is considered fixed. Publishing a corrected manzana does not clear this gate on its own — only amending the upstream advisory to name a patched range does. The removal condition in the file says exactly that, because "when the new manzana ships" is the wrong trigger and would leave someone puzzled when CI stayed red.

Verification, stated honestly

This is not locally verified green. cargo-audit 0.22.1 on an x86_64 host does not report RUSTSEC-2026-0273 at all — manzana surfaces only as Warning: yanked — so a local run passes with or without this ignore and proves nothing.

I ran the negative control and it failed to fail, which is how the vacuity was found rather than shipped. The fix is sound by construction — CI errors on that exact id, and --ignore <id> suppresses that id — and CI is the verifier here, not my box.

Refs #2805.