ADR-0018 ranks the four cargo-vet mechanisms and states that reaching for a
weaker one is a defect. These crates are ours, consumed from crates.io, so
case 2 applies: a publisher-trust entry under h4x0r (user-id 347968), not an
exemption.

The distinction is semantic, not cosmetic. An exemption asserts "unreviewed,
accepted anyway"; a trust entry asserts "the publisher is ours". Recording our
own crates as unreviewed-but-tolerated misstated the supply-chain posture in
the direction of false comfort. A trust entry is also version-agnostic, so it
does not go stale on the next bump the way a pinned exemption does.

Exemption -> trust:
  - blob-decoder
  - forensic-carve
  - forensicnomicon
  - forensicnomicon-core
  - forensicnomicon-data
  - protobuf-forensic-core

Verified (config change, so the vet run is the test):

    Vetting Succeeded (6 fully audited, 143 exempted)
     WARN Your supply-chain has unnecessary exemptions which could be relaxed or pruned.
     WARN   Consider running `cargo vet prune` to prune unnecessary exemptions and imports.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>