fix(deps): replace retired transitive crates

docs/v1-readiness.md

@@ -17,8 +17,8 @@ closure. Their implementation order lives in `PLAN.md`. req: examples/001 req: p
   rollback-safe persistence, restart recovery, health/readiness, diagnostics,
   metrics, CSP, and mixed-build fail-closed recovery proven.
 - V1 closure matrix: local workspace, browser, performance, docs, and example
-  gates pass; `cargo-audit` and `cargo-deny` remain unavailable and block the
-  approved pinned dependency/license audit.
+  gates pass. Warning-denied vulnerability and source audits are clean; strict
+  license closure awaits a repository license allowlist.
 - Publishing and deployment: explicitly unauthorized.
 
 ## Baseline evidence