feat(engine): configure cargo-deny and remove unused bincode dep (#726, #636)

deny.toml: license allowlist + RUSTSEC advisory checking. econ-sim excluded
from graph (path dep, no license). Bincode v1 removed — never imported in
source, RUSTSEC-2025-0141 advisory resolved by deletion.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitignore

@@ -70,6 +70,10 @@ Thumbs.db
 *.swp
 *.swo
 
+# Generated economics pipeline artifacts (re-created by make economy-db)
+wiki/economics/corporations/generated_brands.toml
+wiki/economics/corporations/generated_corporations.toml
+
 # Claude Code internals (plans, session transcripts)
 # Note: .claude/agents/, .claude/skills/, and .claude/settings.json ARE tracked
 .claude/plans/

server/Cargo.lock

@@ -325,15 +325,6 @@ dependencies = [
  "thread_local",
 ]
 
-[[package]]
-name = "bincode"
-version = "1.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1f45e9417d87227c7a56d22e471c6206462cba514c7590c09aff4cf6d1ddcad"
-dependencies = [
- "serde",
-]
-
 [[package]]
 name = "bitflags"
 version = "2.10.0"
@@ -1303,12 +1294,11 @@ dependencies = [
 
 [[package]]
 name = "settled-reach-server"
-version = "0.1.34"
+version = "0.1.35"
 dependencies = [
  "bevy_app",
  "bevy_ecs",
  "bevy_tasks",
- "bincode",
  "clap",
  "crossbeam-channel",
  "econ-sim",

server/Cargo.toml

@@ -2,6 +2,7 @@
 name = "settled-reach-server"
 version = "0.1.35"
 edition = "2021"
+publish = false
 
 [dependencies]
 bevy_ecs = "0.18"
@@ -16,7 +17,6 @@ serde = { version = "1", features = ["derive"] }
 serde_yaml = "0.9"
 ron = "0.8"
 rmp-serde = "1"
-bincode = "1"
 rand = "0.9"
 rand_chacha = "0.9"
 pathfinding = "4.11"

server/audit.toml

@@ -1,9 +1,3 @@
 # cargo audit configuration for settled-reach-server.
 # Known advisories that are tracked but not yet resolved are listed here.
 # New advisories NOT in this list will fail CI.
-
-[advisories]
-# RUSTSEC-2025-0141: bincode v1.3.3 is unmaintained.
-# Migration to bincode v2 or an alternative is tracked in ticket #636.
-# This ignore can be removed once #636 is resolved.
-ignore = ["RUSTSEC-2025-0141"]

server/deny.toml

@@ -0,0 +1,41 @@
+# cargo deny configuration for settled-reach-server.
+# Enforces license allowlist, RUSTSEC advisory checks, and duplicate detection.
+# Run: cargo deny check (from server/)
+
+# econ-sim is an internal path dependency with no license declaration.
+# Excluding it skips only econ-sim itself — its dependencies are still checked
+# because they are shared with settled-reach-server's own dep tree.
+[graph]
+exclude = ["econ-sim"]
+
+[advisories]
+version = 2
+
+[licenses]
+version = 2
+allow = [
+    "MIT",
+    "Apache-2.0",
+    # Needed for wasip2/wit-bindgen (WASM support crates via bevy_tasks).
+    "Apache-2.0 WITH LLVM-exception",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "ISC",
+    "Unlicense",
+    "Zlib",
+    "CC0-1.0",
+    # Required by unicode-ident: "(MIT OR Apache-2.0) AND Unicode-3.0".
+    "Unicode-3.0",
+    # Required by ryu: "Apache-2.0 OR BSL-1.0".
+    "BSL-1.0",
+]
+# settled-reach-server has publish = false and carries no license declaration.
+[licenses.private]
+ignore = true
+
+[bans]
+multiple-versions = "warn"
+
+[sources]
+unknown-registry = "warn"
+unknown-git = "warn"