fix(vet): declare own crates first-party so version bumps don't break supply-chain audit

elephant-diffuser is this repo's own published crate, not a third-party
crates.io dependency. It was declared audit-as-crates-io = true with a
per-version exemption pinned to 0.1.0, so the release-plz v0.1.1 bump made
cargo vet treat the workspace crate as third-party and demand a per-version
audit it cannot carry (the fleet freshness treadmill).

Setting audit-as-crates-io = false makes it first-party — vet requires no
per-version audit, so future version bumps never break supply-chain vet.
The stale 0.1.0 exemption is dropped (cargo vet regenerated the file).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: h4x0r

supply-chain/config.toml

@@ -17,8 +17,4 @@ url = "https://raw.githubusercontent.com/google/rust-crate-audits/main/audits.to
 url = "https://raw.githubusercontent.com/mozilla/supply-chain/main/audits.toml"
 
 [policy.elephant-diffuser]
-audit-as-crates-io = true
-
-[[exemptions.elephant-diffuser]]
-version = "0.1.0"
-criteria = "safe-to-deploy"
+audit-as-crates-io = false