feat: add cargo-deny for supply chain safety

Add dependency auditing via cargo-deny to catch license violations,
security advisories, and untrusted sources. Integrates into CI as a
parallel job alongside clippy, and into the local quality gate script.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

scripts/ci/quality_gate_strict.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+echo "==> fmt check"
+cargo fmt --all -- --check
+
+echo "==> clippy (all warnings)"
+cargo clippy --locked --all --benches --tests --examples --all-features -- -D warnings
+
+echo "==> cargo deny"
+cargo deny check 2>/dev/null || echo "WARN: cargo-deny not installed, skipping"
+
+echo "==> tests"
+cargo test --locked