feat(simulation): add cargo audit to CI/review pipeline (#637)

Add `make audit` target running `cargo audit` with an advisory ignore for
RUSTSEC-2025-0141 (bincode, tracked by #636). Wire audit into `make pre-pr`
and `make pre-pr-server`. Add conditional cargo audit to the pre-commit hook
(triggers only when Cargo.toml/Cargo.lock are staged).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Makefile

@@ -3,6 +3,7 @@ GODOT := $(shell command -v godot4 2>/dev/null || command -v godot 2>/dev/null)
 .PHONY: help setup build check-protocol client server game stop test lint ci ci-client ci-server clean \
        decisions-sync decisions-coverage decisions-active decisions-orphan \
        db-backup db-install validate-content check-fact-ids setup-hooks \
+       audit \
        pre-pr pre-pr-lint pre-pr-build pre-pr-test pre-pr-validate pre-pr-fixtures \
        pre-pr-server pre-pr-client pre-pr-content \
        fixtures-client fixtures-gauntlet golden-diff golden-update \
@@ -45,6 +46,7 @@ help:
 	@echo "  make decisions-coverage Decision-to-ticket coverage by domain"
 	@echo "  make decisions-active   List active decisions"
 	@echo "  make decisions-orphan   Decisions without implementing tickets"
+	@echo "  make audit              Run cargo audit (security advisory check)"
 	@echo "  make validate-content   Validate content YAML against schemas"
 	@echo "  make check-fact-ids    Check fact_id references against knowledge catalogs"
 	@echo "  make fixtures-client    Generate GDScript->Rust cross-encoder fixtures (#475)"
@@ -221,7 +223,7 @@ lint-client:
 
 # --- Pre-PR verification ---
 
-pre-pr: pre-pr-lint pre-pr-build pre-pr-test pre-pr-validate pre-pr-fixtures
+pre-pr: pre-pr-lint pre-pr-build pre-pr-test pre-pr-validate pre-pr-fixtures audit
 	@echo ""
 	@echo "=== PRE-PR: ALL CHECKS PASSED ==="
 	@echo "Safe to create PR."
@@ -274,7 +276,7 @@ pre-pr-fixtures:
 
 # Branch-specific variants (faster, scope-appropriate)
 
-pre-pr-server: lint-server build-server test-server pre-pr-fixtures
+pre-pr-server: lint-server build-server test-server pre-pr-fixtures audit
 	@echo "=== Server pre-PR: PASSED ==="
 
 pre-pr-client: lint-client build-client test-client
@@ -321,6 +323,9 @@ validate-content:
 check-fact-ids:
 	@tooling/check-fact-ids
 
+audit:
+	cd server && cargo audit
+
 checklist-validate:
 	@tooling/validate-checklist --check