docs: retire never-run cargo-vet config and its claims (LAB-3029)

[27Bslash6]

Summary

Follow-up to LAB-3016 / #280. Grooming found the "stale blake3 exemption" was a symptom of a larger trust bug: cargo-vet has never run in this repo.

• rust/supply-chain/ was a cargo vet init snapshot from the 2025-12-10 alpha, never invoked by CI, rust/Makefile, or .pre-commit-config.yaml. audits.toml/imports.lock recorded zero audits ever. 149 of 316 exempted crates are absent from the root Cargo.lock.
• SECURITY.md and DEVELOPMENT.md presented it as an active control with a "Q1 2026" completion target that passed six months ago.
• SECURITY.md's [core-supply-chain] anchor pointed at a heading that doesn't exist in cachekit-core/SECURITY.md (404s silently to the top of the file); the real heading is ### Dependencies.

Decision: retire, don't adopt (attention protocol, Ray 2026-08-04; precedent: docs gate 2026-07-20 + LAB-1037). Adopting cargo-vet for real is a separate Size L+ ticket if wanted — this PR only removes the false posture claim.

Changes

• Deleted rust/supply-chain/{config.toml,audits.toml,imports.lock}.
• SECURITY.md: dropped the cargo-vet table row, the "Audit status: In progress (Q1 2026…)" line, and the Q1-2026 cargo-vet roadmap row (Q2–Q4 rows untouched, out of scope). Added the cargo-audit row actually enforced by security-fast.yml. Fixed the cargo-deny config path (rust/deny.toml → deny.toml, which is where the file actually lives). Renamed "Supply Chain Security" → "Dependency Security" (heading, TOC anchor, and the core-supply-chain reference-link id → core-deps) so no stray anchor/link-id still contains "supply-chain" — verified nothing outside this file links to the old anchor. Fixed the dead cachekit-core cross-repo anchor to #dependencies (verified: exactly one ### Dependencies heading in cachekit-core/SECURITY.md).
• DEVELOPMENT.md: removed the supply-chain/ tree line, swapped cargo-vet → cargo-audit in the Rust security-stack table, deleted the "cargo-vet Exemptions" troubleshooting section.
• README.md: same retired terminology in its security-tooling bullet list ("Supply Chain Security" → "Dependency Security", explicitly credits cargo-audit rather than implying it via "RustSec scanning") — caught by the expert-panel review as a doc surface this change touches.

No workflow files touched; security-fast.yml is unchanged and still runs cargo-audit + cargo-deny.

Verification

• grep -rn -i -E 'cargo.?vet|supply-chain' --exclude-dir=.git . → zero hits.
• deny.toml confirmed at repo root (not rust/deny.toml).
• cachekit-core/SECURITY.md confirmed to have exactly one ### Dependencies heading (line 62); no external repo links to the old #supply-chain-security anchor on this file (org-wide gh search code).
• Pre-commit hooks pass (no source touched, docs-only + config deletion).

Expert-panel review (LAB-2707/workspace gate — Size S, not trivial-exemptible)

Ran bug-hunter-supreme, security-specialist, code-craftsman, catchphrase-agent in parallel.

• bug-hunter-supreme: NO FINDINGS — ships as-is.
• security-specialist: NO FINDINGS — ships as-is. Verified independently that deny.toml/security-fast.yml/the cachekit-core anchor all check out; framed the retired false claim itself as the CWE-1059-style misleading-documentation defect this PR fixes.
• code-craftsman: one finding — README.md:301 carried the same retired "Supply Chain Security" terminology without naming cargo-audit. Applied (see README.md change above).
• catchphrase-agent: NO CUTS — already lean. Confirmed the section rename (needed to fully clear the anchor/link-id "supply-chain" string) and the cargo-audit row/deny.toml path fix are ticket-mandated, not scope creep.

Docs gate

This PR is the docs pass for LAB-3029. docs.cachekit.io (cachekit-io/docs) has no cargo-vet mention (org-wide search, 2026-09-06) — no docs-site change needed.

Test plan

• grep -rn -i -E 'cargo.?vet|supply-chain' --exclude-dir=.git . returns zero hits
• Pre-commit hooks pass locally
• No .github/workflows/* files modified
• Expert-panel review complete, one finding applied

[coderabbitai]

Warning

Review limit reached

Next included review available in 14 seconds.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 103 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: 2b3fc509-b31e-4d05-aee9-3c92500ebb34

📥 Commits

Reviewing files that changed from the base of the PR and between 50fc12f and f22b13d.

⛔ Files ignored due to path filters (1)

• rust/supply-chain/imports.lock is excluded by !**/*.lock

📒 Files selected for processing (5)

• DEVELOPMENT.md
• README.md
• SECURITY.md
• rust/supply-chain/audits.toml
• rust/supply-chain/config.toml

---

_{Comment @coderabbitai help to get the list of available commands.}

[kodus-27b]

Kody Review Complete

Great news! 🎉
No issues were found that match your current review configurations.

Keep up the excellent work! 🚀

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the @kody start-review command at the root of your PR.

• Validate Business Logic: Ask Kody to validate your code against business rules by adding a comment with the @kody -v business-logic command.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

​