fix(deps): clear current cargo-deny failures

[simnaut]

Summary

• Updates crossbeam-epoch from 0.9.18 to 0.9.20, clearing RUSTSEC-2026-0204 from the benchmark/dev-dependency graph.
• Removes the obsolete RUSTSEC-2024-0436 paste waiver now that paste is no longer in the dependency graph.
• Adds an exact spin@0.10.0 yanked-package exception while Bevy 0.19 requires the 0.10 release line. All other yanked packages remain denied.

Rationale

The current Tooling workflow is blocked by both the crossbeam advisory and the yanked spin release.

crossbeam-epoch has a compatible patched release, so the lockfile is updated directly. spin is also present in Bevy 0.19 runtime dependencies, and there is no non-yanked semver-compatible 0.10 release. Bevy upstream PR #25324 moves to spin 0.12.2, but remains open and currently fails Bevy no-std checks. The exact PackageSpec exception avoids an unsupported Bevy fork while keeping the rest of the yanked-crate gate strict.

Failed workflow: https://github.com/simnaut/astrodyn/actions/runs/30893962895

Verification

• cargo-deny 0.20.2 --all-features check
• cargo check --workspace --all-targets
• cargo test --workspace --lib
• git diff --check

[Copilot]

Pull request overview

This PR updates the workspace’s supply-chain policy and lockfile to clear current cargo-deny failures without relaxing the broader deny posture. It keeps the deny.toml audit log up to date with the current resolved dependency graph while unblocking CI.

Changes:

• Bumps the resolved crossbeam-epoch lockfile entry from 0.9.18 to 0.9.20 to address the referenced RustSec advisory in the dev/bench graph.
• Removes the now-obsolete RUSTSEC-2024-0436 ignore entry (since paste is no longer present in Cargo.lock).
• Adds an exact ignore for the yanked spin@0.10.0 while Bevy 0.19 requires the 0.10 release line, preserving denial of other yanked crates.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
deny.toml	Updates cargo-deny advisory/yank handling: drops the old paste waiver and adds an exact yanked spin@0.10.0 ignore with rationale.
Cargo.lock	Updates the resolved dependency graph to crossbeam-epoch 0.9.20.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.