security: revisit optional DiskCache advisory by 2026-10-31

[jason-allen-oneal]

Dependabot alert #7 (GHSA-w8v5-vhqr-4h9v / CVE-2025-69872) has no patched DiskCache release.

Current risk boundary:

• dependency exists only through the optional embed extra via llama-cpp-python
• frozen default/runtime image excludes both llama-cpp-python and DiskCache
• SignalGate does not enable llama-cpp DiskCache or expose a cache-directory sink
• remediation evidence is recorded in PR fix: remediate dependency and supply-chain alerts #14

Reopen the alert before enabling that cache path, changing embed packaging, or when a patched release ships. Review this disposition no later than 2026-10-31.