M0-05: Make cargo-audit availability explicit

[DrunkOnJava]

Created from the roadmap audit in TODO.md.

Source: https://github.com/DrunkOnJava/rvt-rs/blob/main/TODO.md#L175
Tracking commit: 1ec8105

Scope

Labels: priority:P1, type:ci, type:security, area:ci

• Decide whether cargo-audit is required locally or CI-only.
• Add installation notes for maintainers.
• Ensure CI still runs the RustSec advisory check.

Acceptance criteria:

• CONTRIBUTING.md documents how to run advisory checks locally.
• CI has a passing advisory job.
• Local absence of cargo audit is not confused with source failure.

Definition of done

• The TODO acceptance criteria for this section are implemented or explicitly superseded by a linked decision.
• Tests, fixtures, or documentation are added at the level appropriate to the change risk.
• User-facing behavior and limitations remain honest in README/docs/viewer messaging.
• Relevant CI checks pass before the issue is closed.

[DrunkOnJava]

Implemented on main by commits 1ec8105 and d64f3ab.

Verification completed:

• tools/quality.sh --quick passed.
• env RUSTDOCFLAGS="--cfg docsrs -D warnings" cargo +nightly doc --no-deps --all-features passed.
• GitHub issue template YAML parsed successfully.

Local note: cargo-audit is not installed in this sandbox, and cargo-deny could not lock the advisory DB because the sandboxed Cargo home is read-only. The new quality script reports those cases explicitly; CI still enforces supply-chain checks.

Closing as completed.