[Destynova2]

The scheduled audit reports RUSTSEC-2026-0285 but finishes green, and the mutation workflow rebuilds with different features inside its test timeout.

Update rustls from 0.23.40 to 0.23.45 and replace yanked proc-macro-error3 3.0.3 with 3.1.1. Keep scheduled issue reporting, then run cargo audit --deny yanked so unresolved vulnerabilities and yanked crates fail the workflow.

Pass --all-features and --lib to both mutation build and test phases, including PR runs. Share the post-route media gate across feature combinations instead of retaining a cfg-disabled function body that appears as a surviving mutant. Fix test helpers so the media gate can also be checked without policies.

Use squash PR automerge in Renovate to match protected main. The Renovate app is not installed on azerozero; this configuration change does not activate the service.

Validation:

• 1,689 library tests passed with all features; 2 skipped.
• Both media-gate tests passed with media and agents enabled and policies disabled.
• Three targeted mutants caught, including the post-route gate and the previously timing-out status-command comparison.
• Full prek pre-push quality gate passed, plus actionlint, ShellCheck and strict Renovate config validation.
• Audit rejects the original lockfile and passes with the updated dependencies.

Closes #577.

[github-actions]

Mutation testing (PR diff sample)

Informational — never blocks merge. Full matrix runs on main.

Metric	Value
Status	clean
Duration	849 s
Total	37
Caught	0
Missed	0
Timeout	0
Unviable	0

Legend: clean (no survivors), missed (inspect artifact), timed-out (25 min cap reached).

Artifact: mutants-pr-results-82cfffe7a37e1beaad7be07452ab83e92fad4c25.