chore: restore product scaffold to rollback baseline

deny.toml

@@ -37,6 +37,7 @@ allow = [
     "BSL-1.0",
     "Unicode-3.0",
     "CC0-1.0",
+    "CDLA-Permissive-2.0",
 ]
 confidence-threshold = 0.93
 
@@ -61,7 +62,13 @@ yanked = "warn"
 # Empty for v1.0.0-rc.1; if a future advisory blocks the release
 # without a workspace fix, add it here with a tracking issue link
 # and a date.
-ignore = []
+ignore = [
+    # RUSTSEC-2026-0150: audiopus_sys is unmaintained and references
+    # old CMake behavior. Chanora currently patches the `cmake` crate
+    # at workspace level to keep builds working while Opus dependency
+    # replacement is tracked as a release/supply-chain limitation.
+    "RUSTSEC-2026-0150",
+]
 
 # ---------- Bans (versions / packages) ----------
 
@@ -83,6 +90,7 @@ unknown-git = "warn"
 # `Cargo.toml`. Allow the upstream and its workspace members.
 allow-git = [
     "https://github.com/ReSpeak/tsclientlib.git",
+    "https://github.com/EdisonJwa/oboe-rs",
 ]
 
 [sources.allow-org]