deps: audit with mix hex.audit, bump mint and lazy_html

[rubas-agent]

Switches the dependency audit from mix_audit to mix hex.audit, and bumps mint and lazy_html to clear the four advisories it reports.

Before: security.yml and task security:deps ran mix deps.audit (mix_audit 2.1.5).

Problem

• mix_audit reads only a GitHub advisory mirror. It misses the Hex advisory feed (EEF CNA).
• On that feed, our lock had four open advisories.

After: both run mix hex.audit, which reports advisories and retired packages. The mix_audit dependency is gone, with yaml_elixir and yamerl, which only it used. The audit is clean.

Advisory	Severity	Package	Fix
EEF-CVE-2026-91043 (GHSA-9x8p-qrf4-jq7g)	HIGH	mint 1.10.1	mint 1.11.0
EEF-CVE-2026-92103 (GHSA-q95c-ccq6-j5j6)	MEDIUM	mint 1.10.1	mint 1.11.0
EEF-CVE-2026-94194 (GHSA-gvrc-75rc-7gj9)	MEDIUM	mint 1.10.1	mint 1.11.0
EEF-CVE-2026-92106 (GHSA-8rqp-v692-v82q)	LOW	lazy_html 0.1.12	lazy_html 0.1.13

No waivers.

Details

• Hex 2.5.1 or newer is needed for advisories in mix hex.audit. Both workflows run mix local.hex --force, which installs the latest Hex.
• mint 1.11.0 says "no breaking changes". Its other changes are stricter HTTP/1 and HTTP/2 parsing. kagi_ex sends requests through the cloaked_req wreq adapter, so Mint only comes in through Req and Finch and is not on our request path.
• lazy_html 0.1.13 fixes to_html/2 and adds LazyHTML.css_path/1. We only call from_document, query, text, and attribute.
• Checks run locally: MIX_ENV=test mix compile --warnings-as-errors, MIX_ENV=test mix test (54 passed, 3 live tests excluded), and mix hex.audit ("No retired or security advisory packages found").
• Reviewer: nothing to do beyond the usual review.