cargo-deny` and `cargo-audit` gates in CI

[P3az3]

Problem Statement README documents make audit and make deny as local checks only. CI explicitly excludes them. There are no upstream gates for security advisories or denied crates.

Why it matters A repeat of the ed25519-dalek 2.x → 3.x compatibility break (already addressed via [patch.crates-io]) would not be detected upstream until the failure hits production.

Expected Outcome Two new CI jobs (parallel with the existing fmt/clippy/test/wasm-check gates) that run cargo audit and cargo deny check. Both must pass for the build to be green. A deny.toml is committed to the repo and CI uses it explicitly.

Acceptance Criteria

• .github/workflows/ci.yml includes audit and deny jobs.
• deny.toml is committed, listing allowed licenses, banned crates, etc.
• CI steps install cargo-audit and cargo-deny via cargo install --version-locked.
• A simulated bad-deps PR (e.g. by temporarily adding a known-bad crate) fails CI with a clear message.

Implementation Notes

• cargo-deny supports a config-check mode that does not need network access, suitable for offline CI.
• The deny.toml should reference well-known license allowlists (MIT, Apache-2.0, BSD-3-Clause).

Affected Files / Modules

• .github/workflows/ci.yml
• New: deny.toml
• Makefile (parallel targets)

Dependencies — None.