no LGPL: the malachite family (LGPL-3.0-only) is linked into the shipped binary via rustpython-parser #2179

Operator ruling (2026-10-15, relayed by the tier-2 cop): no LGPL in xpile; remove malachite, never allow-list it. Resolves the lgpl-in-shipped-binary owner decision in docs/roadmaps/queue.yaml.

Cause: rustpython-parser 0.4 and rustpython-ast 0.4 enable malachite-bigint by default. Both carry an optional num-bigint feature (MIT OR Apache-2.0) that provides the same BigInt API.

Fix: rustpython-parser = { version = "0.4", default-features = false, features = ["location", "num-bigint"] } in crates/depyler-frontend.

done_when: Cargo.lock has no malachite* package; NOTICE.md lists no LGPL row; a test asserts both and is shown RED on the unfixed tree; the dead RUSTSEC-2024-0436 (paste, via malachite-bigint) ignore leaves deny.toml and docs/audits/advisory-ignores.yaml.

Epic: #2124