Harden first-release validation and dependency hygiene

docs/dependencies.md

@@ -0,0 +1,56 @@
+# Dependency maintenance
+
+Use the committed Cargo.lock. Do not run broad dependency updates as part of
+unrelated changes. Review runtime compatibility and licensing for each update.
+
+## Security audit
+
+```bash
+cargo install cargo-audit --locked --version 0.22.0
+cargo audit --json
+```
+
+The audit fetches the RustSec advisory database and needs network access. Record
+the tool version and database revision with release evidence. Database download
+failure is not a clean scan. Review informational warnings as well as errors;
+unresolved affected vulnerabilities block release. Cargo auditing does not scan
+Debian packages or fully establish the security of native bundled code.
+
+### Reviewed maintenance warning
+
+`serde_cbor 0.11.2` has the informational unmaintained advisory
+[RUSTSEC-2021-0127](https://rustsec.org/advisories/RUSTSEC-2021-0127.html).
+It remains used for persisted repository metadata. Replacing it needs a separate
+storage-compatibility review, not an untested codec substitution during release
+cleanup. The warning remains visible in audit output; no advisory is ignored.
+Operators should protect the state directory from untrusted modification.
+
+## License notices
+
+```bash
+python3 tools/dependency_notices.py --check
+# After a reviewed Cargo.lock change:
+python3 tools/dependency_notices.py
+```
+
+Requirements: Python 3, Cargo, curl, and HTTPS access to the Cargo registry and
+GitHub's raw file service. The tool reads the entire locked dependency graph,
+including build-time and other-platform dependencies, and preserves upstream
+license and notice text. `--check` does not modify tracked files.
+
+Some package archives omit their license file. `tools/license_supplements.json`
+records exact upstream commit URLs and SHA-256 checksums, derived from the
+package's `.cargo_vcs_info.json`. Version changes need a new source review;
+missing texts or checksum mismatches fail rather than silently omit attribution.
+Do not edit original copyright or license wording to match project formatting.
+
+## Coverage
+
+With cargo-llvm-cov and the toolchain's llvm-tools-preview component installed:
+
+```bash
+cargo llvm-cov --locked --all-targets --json --output-path target/coverage.json
+```
+
+Record actual line coverage and tool versions. The release target is 90%.
+Do not exclude production modules or change the denominator to meet the target.