[Tracker]: triage and remove bitmaps unmaintained advisory waiver (RUSTSEC-2026-0247)

Summary

cargo deny check is failing on RUSTSEC-2026-0247 because bitmaps 3.2.1 is in the resolved graph via imbl → Matrix SDK dev-dependencies used by zeroclaw-channels.

Current failure

Security CI currently reports:

• advisory: RUSTSEC-2026-0247
• crate: bitmaps 3.2.1
• class: unmaintained
• recommended alternatives: fixedbitset, bitvec

Why this needs tracking

ZeroClaw's audit policy requires new deny/audit ignores to carry a tracking issue so the waiver is explicit and removable later.

Initial plan

• add a temporary ignore for RUSTSEC-2026-0247 in deny.toml
• mirror the ignore in .cargo/audit.toml
• document it in docs/maintainers/audit-policy.md
• later remove the waiver once the Matrix SDK / imbl chain no longer pulls bitmaps

Affected path

bitmaps -> imbl -> eyeball-im -> matrix-sdk -> zeroclaw-channels (dev-deps)