RUSTSEC-2024-0449 (unsafe-libyaml via serde_yaml 0.9) turns ci / gate red on main #2172

cargo deny check advisories (the ci / gate step) is red on main:

error[unmaintained]: unsafe-libyaml is unmaintained
    ├ ID: RUSTSEC-2024-0449
advisories FAILED

First seen on PR #2171 (run 38477290210, 2026-10-13); reproduced on origin/main locally on 2026-10-15. Main's last push run (2026-10-10) had a green gate, so the advisory-db changed under the tree, not the tree.

Reach (cargo tree -i serde_yaml --all-features): serde_yaml 0.9.34+deprecated → unsafe-libyaml 0.2.11, depended on by xpile, xpile-contracts, xpile-forjar-codegen and the third-party aprender-contracts 0.33.0. Dropping the in-tree uses alone does not clear it.

Plan: (1) a dated ignore, ledgered in docs/audits/advisory-ignores.yaml under the PMAT-2120 expiry gate (owner, owner ticket, removed_by inside the 90-day window, proved live by no_exemption_is_dead); (2) removal: move the in-tree crates off serde_yaml (paiml/ruchy SEC-2 precedent) and take an aprender-contracts release without it, then delete the ignore.