deps: ttf-parser unmaintained (RUSTSEC-2026-0192) has no fixed version — trim/alternative options for the plotting font stack

Companion tracking follow-up from the same security-dependency audit (see the quick-xml issue).

The advisory: RUSTSEC-2026-0192 — ttf-parser is unmaintained. Not a vulnerability; an ecosystem-risk flag. It fails the cargo deny advisories check.

Why no version bump fixes it: no fixed version exists (the crate is unmaintained at every version), and it enters the tree at two points:

ttf-parser (0.15.2 / 0.20.0 / 0.25.1)  <-  plotters 0.3.7   <-  criterion, ruvector-bench, ruvector-benchmarks
ttf-parser                              <-  owned_ttf_parser (ab_glyph font stack)

Note the trap we hit while checking alternatives: switching plotters' font backend to ab_glyph does NOT remove ttf-parser — ab_glyph depends on owned_ttf_parser, which wraps the same crate. Most of the Rust font-parsing ecosystem currently sits on ttf-parser, which is also why "unmaintained" here is lower-risk than it sounds: it is extremely widely deployed and font parsing here only ever touches trusted, locally-bundled fonts in benchmark plot rendering.

Alternatives worth considering:

1. Trim where it comes from: criterion pulls plotters only for HTML reports — if those aren't used in CI, default-features = false on criterion (keeping cargo_bench_support) drops one entry path. The direct plotters deps in the two bench crates would need the same font-free configuration or a text-free backend.
2. Plot outside the graph: emit CSV/JSON from benches and render with external tooling; removes plotters (and the entire font stack) from the workspace.
3. Accept + monitor (what the audit branch documents meanwhile): a deny.toml ignore with rationale, revisited if the advisory ever escalates from unmaintained to vulnerable, or if plotters moves off ttf-parser upstream.

Given the trusted-input usage, option 3 is defensible long-term; filing this so the ignore entry has a visible home rather than being silent configuration.

Start by inspecting the dependency paths for criterion, ruvector-bench, ruvector-benchmarks, plotters, and owned_ttf_parser, then read the existing deny.toml audit rationale. Compare the proposed font-free, external-rendering, and monitored-ignore options. Done means one option is selected, its dependency or audit configuration is updated, and the cargo deny check confirms the intended result.