(MOT-4497) feat(fp,web,workflow,sandbox-code-runner,scrapling): opt-in guidance injection via configuration entries, hot-applied

.github/scripts/tests/test_rust_ci_workflows.py

@@ -114,4 +114,10 @@ def test_rust_security_audit_is_narrow_on_prs_and_complete_on_schedule() -> None
     assert install["with"]["tool"] == "cargo-audit@0.22.2"
     assert "git diff --name-only -z" in run
     assert "find . -name Cargo.lock" in run
-    assert "cargo audit --no-fetch --file" in run
+    assert "cargo audit --file" in run
+    # Every iteration fetches: the yanked check resolves crates against the
+    # index entries fetched by its own invocation, so a no-fetch pass only
+    # sees whatever the first lockfile happened to warm — each additional
+    # lockfile in a PR then fails its yanked lookups. (The workflow's comment
+    # may name the flag; only the invocation form is forbidden.)
+    assert "cargo audit --no-fetch" not in run

.github/workflows/rust-security-audit.yml

@@ -54,15 +54,15 @@ jobs:
           fi
 
           status=0
-          first=1
+          # No --no-fetch on the later iterations: the yanked check resolves
+          # crates against the index entries fetched by THIS invocation, so a
+          # --no-fetch pass only sees whatever the first lockfile happened to
+          # warm — every additional lockfile in a PR then fails its yanked
+          # lookups with "No such crate in crates.io index". The repeat
+          # advisory-db fetch is a fast no-op once the clone is fresh.
           for lockfile in "${lockfiles[@]}"; do
             echo "::group::cargo audit --file $lockfile"
-            if (( first )); then
-              cargo audit --file "$lockfile" || status=1
-              first=0
-            else
-              cargo audit --no-fetch --file "$lockfile" || status=1
-            fi
+            cargo audit --file "$lockfile" || status=1
             echo "::endgroup::"
           done