[AnthonyRonning]

Native Agent audits are blocked by 14 zstd-family advisories. The reviewed store and cursor-theme paths use fresh owned contexts and read-side decoding; the advisory-specific API, feature, state or platform preconditions are absent. This change records that bounded source assessment as 14 explicit exceptions, with per-ID reasons and a public reachability document.

All other vulnerability/unsoundness checks and package bans retain their existing policy. The document pins the reviewed consumers and versions and requires re-review when dependencies, CUA pins, features, call sites or targets change, and removal after upgrading affected packages. Runtime code, dependencies, versions and Research are unchanged. This is source reachability evidence, not an exploit-proof guarantee.

Validation:

• Independent review passed the exact two-file policy/documentation change.
• The official dependency-audit script passed all three supported native targets using current RustSec data.
• A private negative control removing only the 0391 exception failed with 0391 as the sole blocking advisory.
• Formatting, metadata tests and all four strict Clippy passes completed locally. The full local validation run was stopped at the maintainer’s request to publish this focused PR promptly; remaining local tests are not claimed as passed. The commit is signed; its local hook was bypassed for this handoff. Fresh hosted CI remains required before merge.

The 0.0.8 version bump remains separate in #1299; release publication still requires the final merged source, fresh qualified packages and protected signing/publication checks.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}