Name the Git sources the framework arrives through

Stage 3 of decision 0023. cargo deny reports these as unmatched today, which
is correct: nothing depends on them yet. Landing the allowance before the
dependency means the swap in the next commit fails on a compiler error if it
fails at all, rather than on a policy the same change would have had to edit.

zed-industries/font-kit is the one worth reading twice. gpui_wgpu reaches
font-kit through a Git source rather than crates.io, so adopting GPUI brings
two Git sources, not one -- and an allowance discovered while debugging a
failed build is an allowance nobody reviewed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SPYebLiN2w4TqnHUYGdECq

deny.toml

@@ -66,4 +66,14 @@ allow-registry = ["https://github.com/rust-lang/crates.io-index"]
 # block/buzz is the upstream Buzz SDK, rev-pinned in crates/lumbridge-buzz.
 # It has no crates.io release; BUZZ_INTEGRATION.md records why we use its signed
 # protocol semantics rather than inventing a dialect.
-allow-git = ["https://github.com/block/buzz"]
+allow-git = [
+    "https://github.com/block/buzz",
+    # The UI framework, pinned by decision 0023 to a full revision because
+    # crates.io publishing of gpui stopped in October 2025 and the platform
+    # backends now live in crates Zed does not publish at all.
+    "https://github.com/zed-industries/zed",
+    # Not optional and not obvious: gpui_wgpu reaches font-kit through a Git
+    # source of Zed's own, so adopting the framework brings two Git sources
+    # rather than one. Naming it here is what stops that arriving unnoticed.
+    "https://github.com/zed-industries/font-kit",
+]