[iamwavecut]

RUSTSEC-2026-0386 (published after #278's PR checks) marks tokio 1.52.3 unsound: the safe AsyncFd constructors violate I/O safety. cargo deny now fails the dependency gate on main, so the deploy gate refuses 4cbe177.

Only the tokio entry in Cargo.lock changes (1.52.3 → 1.54.1, same dependency list). The workspace does not use AsyncFd.

Checks: cargo deny check (advisories, bans, licenses, sources ok), cargo clippy --workspace --all-targets --locked -- -D warnings.

[github-actions]

	Messages
📖	Danger checked 1 changed file(s).

Generated by 🚫 dangerJS against 084729c

[iamwavecut]

PR-Agent cannot review this PR: it drops Cargo.lock ("Filtered out files with invalid extensions: ['Cargo.lock']"), gets an empty diff and fails with empty_review. Two attempts (run 40030754848) failed the same way. The change is the lock entry alone; cargo deny check and the Rust jobs cover it.