fix(ci): remove invalid job-level hashFiles guard from cargo-audit

The job carried `if: hashFiles('Cargo.lock') != ''`. That is wrong twice
over. `hashFiles` resolves against GITHUB_WORKSPACE, which does not exist at
job-evaluation time — before any checkout — so at job level it can never see
a file that is in the repository. And the run did not SKIP, it FAILED: zero
jobs, no annotation, the startup_failure shape. The expression was rejected
outright rather than evaluating false.

Measured failing on main as well as on this branch, since at least
2026-07-03, so this is pre-existing and not introduced here.

The guard is unnecessary in this repository anyway: vcl-ut has a committed
root Cargo.lock. A repository that genuinely needs it should put it on the
steps after checkout, where hashFiles can see the tree — recorded in a
comment, since this file is template-shared across the estate.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/cargo-audit.yml

@@ -22,7 +22,19 @@ jobs:
     name: Dependency audit
     runs-on: ubuntu-latest
     timeout-minutes: 15
-    if: hashFiles('Cargo.lock') != ''
+
+    # NOTE: this job previously carried `if: hashFiles('Cargo.lock') != ''`.
+    # That guard was wrong in two ways. `hashFiles` resolves against
+    # GITHUB_WORKSPACE, which does not exist at job-evaluation time — before
+    # any checkout — so at job level it could never report a file that is in
+    # the repository. And the run did not skip, it FAILED, with zero jobs and
+    # no annotation: the expression was rejected outright rather than
+    # evaluating false. Measured on main as well as on this branch, failing
+    # since at least 2026-07-03.
+    #
+    # The guard is also unnecessary here: vcl-ut has a committed root
+    # Cargo.lock. A repository that genuinely needs the guard should place it
+    # on the steps AFTER checkout, where hashFiles can actually see the tree.
 
     steps:
       - name: Checkout repository