fix: cd to repo root in strict gate, deny wildcard versions

- quality_gate_strict.sh: add `cd` to repo root so the script works
  when invoked from any working directory.
- deny.toml: change `wildcards = "allow"` to `"deny"` to catch `*`
  version requirements in dependencies.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

deny.toml

@@ -41,7 +41,7 @@ unused-allowed-license = "allow"
 
 [bans]
 multiple-versions = "warn"
-wildcards = "allow"
+wildcards = "deny"
 
 [sources]
 unknown-registry = "deny"

scripts/ci/quality_gate_strict.sh

@@ -1,6 +1,9 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+# Ensure we are running from the repository root
+cd "$(git rev-parse --show-toplevel)"
+
 echo "==> fmt check"
 cargo fmt --all -- --check