ci: add cargo-deny workflow (#38)

* ci: add cargo-deny workflow

Adds a GitHub Actions workflow that runs cargo-deny check on every
pull request and push to main. Uses the existing deny.toml added in
v0.8.0 so CI now enforces the advisory/license/source policy.

Actions pinned by commit SHA:
- actions/checkout@de0fac2e (v6.0.2)
- EmbarkStudios/cargo-deny-action@91bf2b62 (v2.0.17)

Closes the follow-up noted in deny.toml ("CI integration is a
follow-up; this file establishes the policy").

* fix(ci): add minimal contents:read permissions to deny.yml

CodeQL + Cursor flagged missing permissions block. cargo-deny only
reads the repo; explicit contents:read matches ci.yml and release.yml.

Author: avifenesh

.github/workflows/deny.yml

@@ -0,0 +1,26 @@
+name: cargo-deny
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+# Minimal permissions — cargo-deny only needs to read the repo.
+# Matches the pattern used by ci.yml and release.yml. Hardening per
+# CodeQL + cursor review on #38.
+permissions:
+  contents: read
+
+jobs:
+  cargo-deny:
+    name: cargo-deny check
+    runs-on: ubuntu-latest
+    steps:
+      # actions/checkout@v6.0.2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      # EmbarkStudios/cargo-deny-action@v2.0.17
+      - uses: EmbarkStudios/cargo-deny-action@91bf2b620e09e18d6eb78b92e7861937469acedb
+        with:
+          log-level: warn
+          command: check
+          arguments: --all-features