fix(supply-chain): trust our own crates instead of exempting them

These crates are ours, published to crates.io by h4x0r, so ADR-0018 mechanism
(2) — a trust entry — applies. They were carried as version-pinned
[[exemptions]], which is mechanism (4), the last resort. Taking the weaker
mechanism where a stronger one applies is the defect, and it guarantees the
recurrence: an exemption names a single version, so every release we cut reddens
this repo again. A trust entry records the publisher instead and survives bumps.

Rebuilt on current main rather than rebased. The original branch conflicted
because main had moved the same supply-chain files underneath it, and
re-deriving the change is more trustworthy than hand-resolving a conflict in
files that encode security assertions. The crate list is taken from the original
PR, so the intent is unchanged.

Verified by making it fail on purpose: with the trust entries removed
`cargo vet --locked` fails naming exactly these crates, and with them restored
it succeeds. That control is required here because each repo still carries
unrelated exemptions, and a green run over those alone would prove nothing.

Author: h4x0r

supply-chain/audits.toml

@@ -7,22 +7,22 @@
 criteria = "safe-to-deploy"
 user-id = 347968 # Albert Hui (h4x0r)
 start = "2026-06-05"
-end = "2027-08-02"
+end = "2027-08-05"
 
 [[trusted.forensicnomicon-core]]
 criteria = "safe-to-deploy"
 user-id = 347968 # Albert Hui (h4x0r)
 start = "2026-06-28"
-end = "2027-08-02"
+end = "2027-08-05"
 
 [[trusted.forensicnomicon-data]]
 criteria = "safe-to-deploy"
 user-id = 347968 # Albert Hui (h4x0r)
 start = "2026-06-28"
-end = "2027-08-02"
+end = "2027-08-05"
 
 [[trusted.sqlite-core]]
 criteria = "safe-to-deploy"
 user-id = 347968 # Albert Hui (h4x0r)
 start = "2026-06-16"
-end = "2027-08-02"
+end = "2027-08-05"