fix(ci): generate lockfile before security audit

rustsec/audit-check v2 no longer generates Cargo.lock. Create an ephemeral lockfile for the library audit and ignore advisories that only enter through dev dependencies pinned for backward-compatibility and integration tests.

Author: febyeji

.github/workflows/audit.yml

@@ -21,7 +21,12 @@ jobs:
     steps:
       - name: Checkout source code
         uses: actions/checkout@v6
+      - name: Generate Cargo lockfile
+        run: cargo generate-lockfile
       - name: Run security audit
         uses: rustsec/audit-check@v2
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
+          # The affected rustls-webpki version is only pulled in by dev dependencies
+          # pinned for backward-compatibility and integration tests.
+          ignore: RUSTSEC-2026-0098,RUSTSEC-2026-0099,RUSTSEC-2026-0104