chore(deny): exclude buzz-mesh-smoke from cargo-deny graph (#8413)

🤖 Excludes the test-only `buzz-mesh-smoke` crate from the `cargo-deny`
graph via `[graph] exclude` in `deny.toml`.

`buzz-mesh-smoke` holds hardware smoke-test examples; nothing from it
ships. It is the only root-workspace crate that depends on `mesh-llm`,
which brings in `zip` 8.6 (RUSTSEC-2026-0367/-0368/-0369), the `zbus` 5
unmaintained notices (RUSTSEC-2026-0370/-0371/-0372), and `negentropy`
via `mesh-llm-client` → `nostr-sdk` (RUSTSEC-2026-0365). None has a
usable upstream fix for the pinned `mesh-llm` v0.76.2. The `zip` bump
has merged upstream in
[mesh-llm#2471](https://github.com/Mesh-LLM/mesh-llm/pull/2471), but no
`mesh-llm` release contains it yet (latest is v0.78.1).

CI's Security job runs `cargo-deny check` from the repo root, which
reads this `deny.toml`, so the exclusion applies there. These advisories
remain fatal for any shipped crate that pulls in the same dependencies.
No existing advisory ignores were changed.

Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
Co-authored-by: Hayt <211b96e6a2b7f45fd4047988976c7bbbeeda0c15f3ae7b32eec20834b5a55118@buzz.block.builderlab.xyz>

deny.toml

@@ -1,3 +1,9 @@
+[graph]
+# buzz-mesh-smoke is a test-only hardware smoke-test crate; nothing from it ships.
+# It is the only root-workspace crate depending on mesh-llm, whose zip/zbus
+# advisories have no usable upstream fix for our pinned version.
+exclude = ["buzz-mesh-smoke"]
+
 [advisories]
 ignore = [
     # instant 0.1.13 — unmaintained crate. Transitive dep: nostr → instant.