chore(rust): sync Cargo.lock + Phase 4 Rust pilot audit (2026-05-30)

[lusoris]

Summary

Phase 4 Rust pilot audit per the language-modernization plan. Inspected
both Rust crates in tree (vmafx-sys FFI bindings, vmafx-tad cbindgen
pilot) for build health, clippy warnings, test coverage, formatting, and
security advisories. Found one real defect: the committed Cargo.lock
was missing 31 build-dependency entries (bindgen 0.69 + cbindgen 0.27
and their transitives), which cargo build silently regenerated on every
fresh checkout. Lockfile is now in sync; no version churn, no MSRV impact.

Type

• chore — maintenance / cleanup
• fix — Cargo.lock drift fix

Audit findings

Gate	Result
cargo build (dev + release)	clean
cargo test	15 / 15 pass (Netflix integration test gracefully skips without YUV)
cargo clippy --all-targets -- -D warnings	0 findings
cargo fmt --check	clean
cargo audit	0 advisories (1099 scanned)
Cargo.lock integrity	drift — 31 missing build-dep crate entries (FIXED)

Checklist

• Conventional Commits.
• cargo build + cargo clippy + cargo test + cargo fmt green.
• No .c / .cpp / .cu / .h files added.
• No breaking change.

Bug-status hygiene (ADR-0165)

• no state delta: pilot-audit chore — no bug opened, closed, or ruled out.

Netflix golden-data gate (ADR-0024)

• No assertAlmostEqual value modified.
• No Python-test files touched.

Deep-dive deliverables (ADR-0108)

• Research digest — no digest needed: mechanical audit (run cargo gates, refresh lockfile).
• Decision matrix — no alternatives: only-one-way fix (regenerate Cargo.lock from cargo build).
• AGENTS.md invariant note — no rebase-sensitive invariants: lockfile resolution is deterministic from manifests.
• Reproducer / smoke-test command — see Reproducer.
• CHANGELOG fragment — changelog.d/fixed/rust-pilot-audit-2026-05-30.md.
• Rebase note — docs/rebase-notes.md entry rust-pilot-audit-2026-05-30.

Reproducer

# From a clean checkout of master:
cd $(git rev-parse --show-toplevel)
cargo build 2>&1 | tail -5
git diff --stat Cargo.lock    # BEFORE this PR: shows hundreds of additions
cargo clippy --all-targets -- -D warnings
cargo test
cargo fmt --check
cargo audit
# AFTER this PR: `git diff --stat Cargo.lock` is empty after cargo build.

🤖 Generated with Claude Code

[lusoris]

Closing as part of marathon cleanup 2026-05-31 (150 PRs merged today). Content likely superseded by sibling merges. Reopen if specific finding still needs work; bigger PRs preferred going forward per session feedback.

[lusoris]

Closing per triage 2026-06-01: STALE-NOOP: Cargo.lock build-dep sync already on master (104 packages, 919 lines). Branch preserved.