Remove the font-stack advisory ignores (RUSTSEC-2026-0192 ttf-parser / RUSTSEC-2026-0206 rustybuzz) once resvg's harfrust port reaches the gpui pin #224

deny.toml carries two ignores for the unmaintained RazrFalcon font crates:

• RUSTSEC-2026-0192 — ttf-parser (ignored since ci(deny): ignore RUSTSEC-2026-0192 (ttf-parser unmaintained) #159)
• RUSTSEC-2026-0206 — rustybuzz (ignored since chore(deny): #221 · ignore RUSTSEC-2026-0206 — rustybuzz unmaintained, transitive via gpui/usvg #222 / Daily cargo-deny advisory scan is failing #221)

Both enter the tree only through the pinned gpui stack (rustybuzz/ttf-parser ← usvg/resvg ← gpui, plus gpui's own direct ttf-parser in gpui/src/svg_renderer.rs), so they clear together in one gpui bump — this issue tracks that chain so the ignores don't outlive their reason. Successors are harfrust (shaping, ready) and fontations/skrifa (parsing, ready); what's missing is the consumer chain.

Upstream sequence (each step observable, check off as it lands)

• Port resvg to harfrust and fontations linebender/resvg#922 merges — the maintainer-authored port to harfrust/fontations. Named blocker: fontdb → fontique. Watch this, don't duplicate it.
• resvg/usvg release ships the new text stack (0.48+ — 0.47.0 is still on rustybuzz/ttf-parser).
• Zed bumps workspace resvg/usvg past 0.47 and ports gpui/src/svg_renderer.rs off direct ttf-parser. (Zed main is red on the same advisories — they're motivated; if they haven't moved shortly after the resvg release, this bump is a well-scoped PR we can send them.)
• just bump-gpui works again — currently broken (two-gpui-copies build failure, see Daily cargo-deny advisory scan is failing #169 notes). Local prerequisite; without it nothing upstream reaches us.
• Bump the pin, then delete both ignore entries from deny.toml and confirm cargo deny check advisories is green.

Done

Both entries gone, advisories green, and the "re-evaluate on just bump-gpui" markers with them. If a bump lands while linebender/resvg#922 is still unmerged, re-check whether either advisory resolved anyway and narrow accordingly — don't let the entries ride unexamined (the #175 lesson: keep the ignore's trigger accurate).