chore(ci): main is red on Cargo Security, cargo vet reports 29 unvetted crates after the #1048 lockfile refresh

[BryanFRD]

main is red on Cargo Security. #1048 landed the lockfile refresh and cargo vet now reports 29 unvetted dependencies: run 35265784508 on 5fde09e.

cargo vet (supply-chain audit) is the only failing step. cargo audit, cargo deny and cargo machete all pass, so this is uncertified provenance on crates the refresh moved, not a known-bad crate.

This is the same shape as #1019 after #906, and the same cost of the #1018 design: the gate is advisory on a Renovate lockfile pull request and enforced on main, so a lockfile refresh merges green and fires on the next push to main.

It also blocks every human-authored pull request, since the gate is hard for anyone but the bot. #1055 is green on everything else and cannot merge until this is cleared.

Verified

$ git checkout origin/main && cargo vet
Vetting Failed!
29 unvetted dependencies:
  bitflags:2.13.2 missing ["safe-to-deploy"]
  cc:1.4.6 missing ["safe-to-deploy"]
  ...

Reproduces on main alone, so no open branch is responsible.

Fix

cargo vet regenerate exemptions, as in #1019. Worth noting this is now the second time, roughly six weeks apart, and each pass adds to a number that only goes up. #1017 remains the place to decide whether to certify, import more audit sets, or stop running cargo vet.