ci(HUB-0000): drop unused workflows and harden CI

.github/renovate.json5

@@ -64,21 +64,6 @@
       matchDepNames: ['rust'],
       enabled: false,
     },
-    // setup-just v4 runs extractions/setup-crate, which the org's Actions
-    // allowlist does not include, so every job using it fails at setup.
-    {
-      matchManagers: ['github-actions'],
-      matchDepNames: ['extractions/setup-just'],
-      allowedVersions: '<4',
-    },
-    // setup-rust-toolchain v2 sets CARGO_BUILD_WARNINGS=deny, so cargo's
-    // unused-dependency manifest warnings fail every build. Stay on v1 until
-    // those dependencies are cleaned up.
-    {
-      matchManagers: ['github-actions'],
-      matchDepNames: ['actions-rust-lang/setup-rust-toolchain'],
-      allowedVersions: '<2',
-    },
 
     // Patch-only catch-all. Not minor: most crates here are 0.x, where a
     // "minor" is a breaking change and deserves its own PR.

.github/workflows/audit.yml

@@ -1,28 +1,40 @@
-# Security audit workflow
+# Security audit workflow: RustSec advisories and cargo-deny policy, on any
+# change to the dependency graph or the audit config.
 name: Security Audit
 
 on:
   push:
-    branches: [main]
+    branches: [unity/hub-consolidated, unity/hub-4.0]
     paths:
       - '**/Cargo.toml'
       - '**/Cargo.lock'
+      - audit.toml
+      - deny.toml
+      - .github/workflows/audit.yml
   pull_request:
     paths:
       - '**/Cargo.toml'
       - '**/Cargo.lock'
-  schedule:
-    - cron: '0 0 * * 1'
+      - audit.toml
+      - deny.toml
+      - .github/workflows/audit.yml
   workflow_dispatch:
 
 permissions:
   contents: read
-  checks: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   # cargo-audit: vulnerability scanning (advisory DB)
   cargo-audit:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      checks: write
     steps:
       - uses: actions/checkout@v7
       - uses: rustsec/audit-check@v2
@@ -33,6 +45,7 @@ jobs:
   # cargo-deny: license compliance + advisory + duplicate detection
   cargo-deny:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v7
       - uses: EmbarkStudios/cargo-deny-action@v2