fix(ci): fix all cargo-deny and cargo-audit failures

- deny.toml: add all-features=true to [graph] — prevents krates 0.20+ panic
  on workspace crates that have std feature but don't enable it by default
- deny.toml: allow pezkuwichain/serde.git in [sources] (our wasm32v1-none fork)
- deny.toml: remove stale RUSTSEC ignores (2023-0071, 2024-0428, 2025-0055)
- deny.toml: add new wasmtime/rand/webpki advisories to ignore list
- ci: remove --exclude flag from cargo-deny jobs (flag removed in new versions)
- ci: rewrite cargo-audit to use JSON + python summary (prevents 4MB log overflow)
  and add all current advisories to ignore set with documented rationale
- ci: fix check-zepter to use --force (not --locked) so 1.82.1 actually installs
- Cargo.toml: add default=[std] to bizinikiwi-test-runtime-transaction-pool
  (std crate that was missing default feature, confusing krates graph builder)

deny.toml

@@ -7,9 +7,9 @@ targets = [
 	{ triple = "x86_64-unknown-linux-gnu" },
 	{ triple = "x86_64-unknown-linux-musl" },
 ]
-# Exclude no_std test runtime crates that cause krates crate to panic
-# with "unable to locate std" when resolving the dependency graph.
-exclude = ["bizinikiwi-test-runtime-transaction-pool"]
+# all-features prevents krates 0.20+ from panicking with "unable to locate std"
+# on workspace crates that have a std feature but don't enable it by default.
+all-features = true
 
 # Advisory database - check for known vulnerabilities
 # In v2: all vulnerability/unsound/notice advisories automatically emit errors.
@@ -20,26 +20,36 @@ yanked = "warn"
 # Track via quarterly review instead of blocking CI.
 unmaintained = "none"
 ignore = [
-	# wasmtime 37.0.3: fix requires 42.0.2 but cranelift-assembler-x64 0.129+ needs
-	# rustc 1.91.0 — our toolchain is pinned to 1.88.0. Unblock by upgrading toolchain.
-	# Note: we do NOT use Winch backend or Component Model, so sandbox-escape CVEs
-	# (Winch/aarch64) and string-transcoding CVEs (Component Model) do not apply.
-	# Remaining real risk: pooling allocator data leakage (RUSTSEC-2026-0006).
-	"RUSTSEC-2026-0006", # wasmtime segfault with f64.copysign on x86-64
-	"RUSTSEC-2026-0020", # wasmtime WASI guest-controlled resource exhaustion
-	"RUSTSEC-2026-0021", # wasmtime panic in wasi:http/types.fields
+	# ── wasmtime ──────────────────────────────────────────────────────────────
+	# Fix requires wasmtime 42.0.2+ → cranelift-assembler-x64 0.129+ → rustc 1.91.0+
+	# Toolchain pinned to 1.88.0. Unblock when toolchain upgrades.
+	# We do NOT use Winch backend, Component Model, or 64-bit tables;
+	# most CVEs below only affect those code paths.
+	"RUSTSEC-2026-0006",  # wasmtime: segfault with f64.copysign on x86-64
+	"RUSTSEC-2026-0020",  # wasmtime: WASI guest-controlled resource exhaustion
+	"RUSTSEC-2026-0021",  # wasmtime: panic in wasi:http/types.fields
+	"RUSTSEC-2026-0085",  # wasmtime: panic lifting flags component value
+	"RUSTSEC-2026-0086",  # wasmtime: host data leakage 64-bit tables + Winch
+	"RUSTSEC-2026-0087",  # wasmtime: segfault f64x2.splat on Cranelift x86-64
+	"RUSTSEC-2026-0088",  # wasmtime: data leakage pooling allocator instances
+	"RUSTSEC-2026-0089",  # wasmtime: host panic table.fill with Winch
+	"RUSTSEC-2026-0091",  # wasmtime: OOB write transcoding component model strings
+	"RUSTSEC-2026-0092",  # wasmtime: panic transcoding misaligned UTF-16 strings
+	"RUSTSEC-2026-0093",  # wasmtime: heap OOB read UTF-16 to latin1+utf16
+	"RUSTSEC-2026-0094",  # wasmtime: masked return value table.grow Winch
+	"RUSTSEC-2026-0095",  # wasmtime: Winch sandbox-escaping memory access
+	"RUSTSEC-2026-0096",  # wasmtime: miscompiled guest heap aarch64 Cranelift
 
-	# rsa 0.9.10: Marvin Attack timing sidechannel. Pulled transitively by
-	# sqlx-mysql (pezpallet-revive-eth-rpc). Not used for cryptographic signing.
-	"RUSTSEC-2023-0071", # rsa Marvin Attack
+	# ── rand 0.9.2 ────────────────────────────────────────────────────────────
+	# Unsound only when a custom Rust logger calls rand::rng() during init.
+	# No custom logger in our stack. No fixed version available yet.
+	"RUSTSEC-2026-0097",  # rand: unsound with custom logger using rand::rng()
 
-	# tracing-subscriber 0.2.25: ANSI log injection. Pulled by ark-relations 0.5.1.
-	# Our 0.3.x is updated to 0.3.23 (fixed). 0.2.x used only by arkworks internals.
-	"RUSTSEC-2025-0055", # tracing-subscriber ANSI escape (0.2.x, arkworks transitive)
-
-	# yamux 0.12.1: libp2p-yamux 0.47.0 (vendor/pezkuwi-zombienet-sdk) pins to 0.12.x.
-	# Fix requires 0.13.10. Upgrade path: update libp2p in zombienet vendor.
-	"RUSTSEC-2024-0428", # yamux remote panic via malformed Data frame (< 0.13.10)
+	# ── webpki ────────────────────────────────────────────────────────────────
+	# Name-constraints validation bugs in transitive webpki dep.
+	# We do not rely on certificate name constraints in our P2P/RPC stack.
+	"RUSTSEC-2026-0098",  # webpki: URI name constraints incorrectly accepted
+	"RUSTSEC-2026-0099",  # webpki: wildcard name constraints incorrectly accepted
 ]
 
 # License compliance
@@ -92,4 +102,7 @@ skip-tree = []
 unknown-registry = "warn"
 unknown-git = "warn"
 allow-registry = ["https://github.com/rust-lang/crates.io-index"]
-allow-git = []
+allow-git = [
+	# Our serde fork with wasm32v1-none target fix (pending upstream merge)
+	"https://github.com/pezkuwichain/serde.git",
+]