Embed the dependency list in release binaries with cargo-auditable #2974

Thanks for prek, and for shipping #2919 so quickly.

What happened. prek 0.5.6 and earlier bundle webpki-root-certs 1.0.9, which RUSTSEC-2026-0383 covers: the bundle trusts the emSign ECC Root CA - G3, whose intermediates' keys were compromised. 0.5.7 moved to 1.0.10. No advisory names prek itself, though, so a scanner that looks prek up by its own name found nothing for 0.5.5. We only noticed by reading Cargo.lock at the tag by hand.

The request. Please build the release binaries with cargo-auditable. It embeds the resolved dependency list in a .dep-v0 section of the binary. Scanners read that section directly, cargo audit bin among them, and the cargo-auditable README lists the others. Then an advisory against a crate prek bundles shows up against the prek binary, and nobody has to file one against prek.

uv already does this. Its 0.13.5 linux x86_64 binary carries the section, and prek 0.5.7's does not. Both releases are built with cargo-dist 0.32.0, so uv's setup may carry over directly:

• scripts/cargo.sh and scripts/cargo.cmd, a wrapper that runs cargo auditable in place of cargo;
• scripts/install-cargo-extensions.sh, which installs it;
• scripts/check-release-artifact-sboms.sh, which checks every release artifact carries the data.

Happy to test a build if that helps.