chore: document optional DiskCache OSV exception

[jason-allen-oneal]

What changed

• add a root osv-scanner.toml exception for PYSEC-2026-2447
• expire the exception on 2026-10-31
• link the precise optional-dependency boundary to issue security: revisit optional DiskCache advisory by 2026-10-31 #15

Why

DiskCache currently has no patched release. SignalGate reaches it only through the optional embed extra, while the default dependency set and runtime image exclude both DiskCache and llama-cpp-python. SignalGate does not enable the vulnerable cache path.

This is a time-bounded scanner policy, not a runtime or dependency change. Issue #15 remains open to require reassessment before the deadline, before enabling that cache path, when embed packaging changes, or when a patched DiskCache release becomes available.

Validation

• OSV Scanner 2.5.1 release binary verified against its published SHA-256 checksum
• recursive OSV scan: PYSEC-2026-2447 and its aliases filtered for the documented reason; no actionable issues remain
• uv lock --check
• uv sync --locked --extra dev
• uv run --locked ruff check .
• uv run --locked pytest -m "not e2e" -ra: 38 passed, 3 deselected
• TOML parse and git diff --check

Pinned base: 9afd71e701fbd3e04f05b715f63a4d36b1c1b45c

Tracked by #15.

[morrow-bluedot]

Independent exact-head review at f8db279: the root OSV policy filters only the reviewed optional DiskCache advisory and aliases through 2026-10-31, issue 15 tracks reassessment, scans report no actionable findings, and all hosted CI, fuzz, Docker, and CodeQL checks pass.