Summary

Embed the linked Rust dependency graph in gateway and supervisor binaries used by Release Dev and Release Tag images. This makes shipped binaries directly inspectable by Syft and other cargo-auditable consumers while keeping PR, E2E, and standalone artifact builds unchanged by default.

Related Issue

Closes #2686

Changes

• Pin cargo-auditable 0.7.5 with locked artifacts for all supported mise platforms
• Add an opt-in auditable input through the Docker and native Rust build workflows
• Enable auditable builds only for release gateway and supervisor images
• Unset sccache around auditable compiler invocations to avoid wrapper chaining failures
• Verify release binaries by requiring Syft to decode Cargo packages
• Add OPENSHELL_AUDITABLE=1 for equivalent local prebuilt staging
• Document auditable binary metadata and its distinction from source-tree and OCI SBOMs

Testing

• mise run pre-commit
• mise run test
• Built auditable amd64 gateway and supervisor prebuilts locally
• Syft decoded 491 gateway and 358 supervisor Cargo packages
• Gateway retained its GLIBC 2.28 symbol floor
• Supervisor remained fully static
• Release amd64/arm64 matrix — exercised by Release Dev after merge

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)

Coordination

PR #2677 also updates mise.toml and mise.lock; if it merges first, the lockfile should be regenerated with both tools present.