docs(ci): correct the cargo-audit rationale to the real dependency surface (#125)

[Xof]

Closes #125. Stacked on #156. Comment-only — no behaviour change.

The comment justifying the scope of the supply-chain gate said the root crate ships "only xxhash-rust and libc as production deps — both well-maintained — so the practical risk surface is small".

That has been false since encryption landed. The root [dependencies] block lists nine direct production deps, six of them cryptographic:

xxhash-rust, libc, rustc-hash,
chacha20poly1305, argon2, hkdf, sha2, zeroize, getrandom

They are unconditional — there is no encryption feature gate, so the seal/open code is always compiled. The audit surface is the whole RustCrypto AEAD/KDF stack plus its transitives, not two leaf utilities.

It is false in the direction that matters. This comment is the recorded reason the repo runs this much supply-chain tooling and no more; a reader deciding whether cargo audit alone is sufficient makes that call from it, and a two-dependency picture argues for less tooling than a crypto stack does.

Also recorded: the two MSRV-motivated downgrade pins

Pin	Why held back
zeroize = "~1.8"	1.9.0 went edition2024 (needs Rust 1.85+)
base64ct = "~1.6"	1.7+ went edition2024; floor-pinned because argon2 0.5.3 depends on it transitively

Both preserve the 1.82 floor the msrv job enforces. Deliberately held back means deliberately not receiving upstream fixes, and nothing else in CI would surface that — so they belong in the comment that decides how much supply-chain scrutiny this repo applies.

Left stated, not answered

There is no deny.toml, so nothing gates on licenses, duplicate versions, or banned crates. That was a defensible call for a two-dependency tree; it is a more substantial one now. Flagged in the comment as a decision to make rather than silently resolved here.