Fix Tantivy 0.26 build break and add cargo-audit CI

- Fix TopDocs::with_limit() call in verisim-document to use
  .order_by_score() as required by Tantivy 0.26 Collector trait
- Add cargo-audit CI workflow for dependency vulnerability scanning
  (runs on PR, push to main, and weekly schedule)

All 23 verisim-document tests pass (17 unit + 6 property).

https://claude.ai/code/session_01FxxUVqL8xdA34j7n3Ep52S

Author: claude

.github/workflows/cargo-audit.yml

@@ -0,0 +1,44 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+#
+# cargo-audit.yml — Dependency vulnerability scanning for Rust projects.
+# Runs cargo-audit against the RustSec advisory database.
+name: Cargo Audit
+
+on:
+  pull_request:
+    branches: ['**']
+  push:
+    branches: [main, master]
+  schedule:
+    # Run weekly on Monday at 06:00 UTC to catch new advisories.
+    - cron: '0 6 * * 1'
+
+permissions:
+  contents: read
+
+jobs:
+  audit:
+    name: Dependency audit
+    runs-on: ubuntu-latest
+    if: hashFiles('Cargo.lock') != ''
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
+
+      - name: Install cargo-audit
+        run: cargo install cargo-audit --locked
+
+      - name: Run cargo audit
+        run: cargo audit
+
+      - name: Write summary
+        if: always()
+        run: |
+          echo "## Cargo Audit Results" >> "$GITHUB_STEP_SUMMARY"
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+          cargo audit 2>&1 | tail -20 >> "$GITHUB_STEP_SUMMARY" || true

rust-core/verisim-document/src/lib.rs

@@ -275,7 +275,8 @@ impl DocumentStore for TantivyDocumentStore {
             QueryParser::for_index(&self.index, vec![self.schema.title, self.schema.body]);
 
         let parsed_query = query_parser.parse_query(query)?;
-        let top_docs = searcher.search(&parsed_query, &TopDocs::with_limit(limit))?;
+        let top_docs =
+            searcher.search(&parsed_query, &TopDocs::with_limit(limit).order_by_score())?;
 
         // Create snippet generator for body field
         let snippet_generator =