security.yml: allow the cargo-geiger matrix-voice step to fail without blocking (repo owner decision)

Confirmed upstream tool bug, not a code defect: cargo-geiger 0.13.0 (latest
release; 0.12.0 reproduces identically) bundles cargo 0.86.0 as a library,
whose internal clean/download-batching panics on this project's matrix-voice
dependency graph with "assertion failed: self.pending_ids.insert(id)" in
cargo::core::package::Downloads::start. Reproduced locally, independent of
CI, on both available cargo-geiger releases. No newer release exists.
cargo check/build/test for matrix-voice all pass clean.

Matches the existing continue-on-error precedent already on the cargo audit
step in this same job. Every other step in dependency-and-secret-audit
(secret scanning, SBOM, license/source policy, other feature scans) still
blocks normally.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: 2 people

.github/workflows/security.yml

@@ -96,6 +96,20 @@ jobs:
         run: cargo deny --locked check licenses sources
       - name: Record Matrix voice unsafe-code inventory
         working-directory: mesh/src-tauri
+        # cargo-geiger 0.13.0 (the latest release; 0.12.0 reproduces identically)
+        # bundles cargo 0.86.0 as a library, whose internal clean/download-batching
+        # panics on this project's matrix-voice dependency graph:
+        # "assertion failed: self.pending_ids.insert(id)" in
+        # cargo::core::package::Downloads::start, called from cargo_geiger's own
+        # pre-scan cargo_clean::clean step. Confirmed independent of this repo's
+        # code: cargo check/build/test for matrix-voice all pass clean, and the
+        # crash reproduces locally with no CI-specific factors involved. No newer
+        # cargo-geiger exists to fix it. continue-on-error so this known upstream
+        # tool bug doesn't block merges; every other step in this job (secret
+        # scanning, SBOM, license/source policy, other feature scans) still
+        # blocks normally. Matches the existing continue-on-error precedent on
+        # the cargo audit step above.
+        continue-on-error: true
         run: >-
           cargo geiger
           --no-default-features