chore: bump regorus 0.2.8 → 0.10 to fully clear RUSTSEC-2026-0097

The audit fix in PR #110 bumped rand 0.9.x to 0.9.4 but left the
residual rand 0.8.5 in place (pulled by regorus 0.2.8). That instance
was carried under an --ignore RUSTSEC-2026-0097 in supply-chain.yml
and deny.toml with a comment "tracked for upstream resolution; sigil
does not use custom rand loggers."

regorus 0.10 is now out and drops the rand 0.8.5 transitive from the
dep graph entirely. With it gone, the ignore entry in deny.toml and
the matching --ignore flag in supply-chain.yml are no longer needed —
cargo audit returns 0 vulnerabilities (excluding the unmaintained
rustls-pemfile, which stays in the ignore list pending upstream
deprecation).

The regorus dep is feature-gated behind `--features rego` and is
optional for power users of the Rego policy language; default builds
do not use it. cargo build (default), cargo build --features rego,
and cargo test --no-run --features rego all clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: avrabe

.github/workflows/supply-chain.yml

@@ -48,10 +48,9 @@ jobs:
       run: cargo install --locked cargo-audit
     - name: Run cargo audit
       # Ignore list stays in sync with deny.toml [advisories].ignore.
-      # RUSTSEC-2026-0097 (rand): bumped to 0.9.4 in this branch to clear
-      # the 0.9.x instance; the residual 0.8.5 transitive via regorus
-      # cannot be patched until regorus 0.3+ ships. wsc does not use
-      # custom rand loggers, so the unsoundness does not affect us.
+      # RUSTSEC-2026-0097 (rand 0.8.5 transitive) was removed from this
+      # list when regorus was bumped 0.2.8 → 0.10 — the residual 0.8.5
+      # instance now drops out of the dep graph entirely.
       run: |
         cargo audit \
           --ignore RUSTSEC-2025-0046 \
@@ -61,8 +60,7 @@ jobs:
           --ignore RUSTSEC-2026-0021 \
           --ignore RUSTSEC-2025-0057 \
           --ignore RUSTSEC-2025-0134 \
-          --ignore RUSTSEC-2024-0436 \
-          --ignore RUSTSEC-2026-0097
+          --ignore RUSTSEC-2024-0436
 
   cargo-deny:
     name: Cargo Deny