feat: add cargo-deny for supply chain safety (#834)

* feat: add cargo-deny for supply chain safety

Add dependency auditing via cargo-deny to catch license violations,
security advisories, and untrusted sources. Integrates into CI as a
parallel job alongside clippy, and into the local quality gate script.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* fix: use cargo-deny action in CI, improve quality gate script

- Use EmbarkStudios/cargo-deny-action@v2 instead of cargo install
  for faster CI execution
- Fix quality_gate_strict.sh to check for cargo-deny availability
  instead of suppressing stderr

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* fix: add missing Unlicense and CDLA-Permissive-2.0 to license allowlist

Add Unlicense (used by aho-corasick, memchr, etc.) and
CDLA-Permissive-2.0 (used by webpki-roots) to prevent
cargo deny check from failing on the current dependency tree.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* chore: trigger CI after retargeting PR to staging

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* fix: use valid cargo-deny v0.19 syntax for unmaintained advisories

The `unmaintained` field in [advisories] accepts "all", "workspace",
"transitive", or "none" — not "warn". Use "workspace" to flag
unmaintained direct dependencies without failing on transitive ones.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* chore: re-trigger CI after adding skip-regression-check label

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* fix: migrate deny.toml [licenses] to version 2 format

Remove deprecated `unlicensed` and `default` fields, add `version = 2`.
In v2, all licenses are denied unless explicitly in the allow list,
making these fields redundant.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* fix: ignore pre-existing advisories in deny.toml with justification

Add known RUSTSEC IDs to the ignore list so cargo-deny CI passes.
Each advisory is documented with mitigation context. Dependency
upgrades to resolve these should be tracked separately.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* fix: address PR review feedback for cargo-deny integration

- quality_gate_strict.sh: fail hard when cargo-deny is not installed
  instead of silently skipping, and let set -e handle check failures
- deny.toml: remove empty [graph].targets so cargo-deny checks all
  platforms instead of only the runner's default target

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* fix(deny.toml): correct serde_yml advisory comment to reflect direct dependency

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* fix: tighten clippy-windows check in roll-up job

Change from checking only `== "failure"` to checking
`!= "success" && != "skipped"`. This ensures any unexpected
result (e.g., cancelled) also blocks the merge, while still
allowing the expected "skipped" state for non-main PRs.

Addresses zmanian's review feedback on PR #834.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* fix: cd to repo root in strict gate, deny wildcard versions

- quality_gate_strict.sh: add `cd` to repo root so the script works
  when invoked from any working directory.
- deny.toml: change `wildcards = "allow"` to `"deny"` to catch `*`
  version requirements in dependencies.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

---------

Co-authored-by: Claude Opus 4.6 <[email protected]>

.github/workflows/code_style.yml

@@ -16,6 +16,15 @@ jobs:
     - name: Check formatting
       run: cargo fmt --all -- --check
 
+  deny-check:
+    name: cargo-deny
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v6
+    - name: Run cargo deny
+      uses: EmbarkStudios/cargo-deny-action@v2
+
   clippy:
     name: Clippy (${{ matrix.name }})
     runs-on: ubuntu-latest
@@ -71,18 +80,18 @@ jobs:
 
   # Roll-up job for branch protection
   code-style:
-    name: Code Style (fmt + clippy)
+    name: Code Style (fmt + clippy + deny)
     runs-on: ubuntu-latest
     if: always()
-    needs: [format, clippy, clippy-windows]
+    needs: [format, clippy, clippy-windows, deny-check]
     steps:
       - run: |
-          if [[ "${{ needs.format.result }}" != "success" || "${{ needs.clippy.result }}" != "success" ]]; then
+          if [[ "${{ needs.format.result }}" != "success" || "${{ needs.clippy.result }}" != "success" || "${{ needs.deny-check.result }}" != "success" ]]; then
             echo "One or more jobs failed"
             exit 1
           fi
-          # clippy-windows only runs on main PRs, so skip/success are both acceptable
-          if [[ "${{ needs.clippy-windows.result }}" == "failure" ]]; then
-            echo "Windows clippy failed"
+          # clippy-windows only runs on main PRs, so skipped is acceptable but failure is not
+          if [[ "${{ needs.clippy-windows.result }}" != "success" && "${{ needs.clippy-windows.result }}" != "skipped" ]]; then
+            echo "Windows clippy failed: ${{ needs.clippy-windows.result }}"
             exit 1
           fi