ci: enforce dependency policy

[shayyz-code]

Summary

• enforce strict advisory, license, version, and source rules with cargo-deny 0.20.2
• run a pinned dependency policy check on pull requests, manual dispatch, and a weekly schedule
• document Rust and native dependency review requirements and future release SBOM work

Verification

• cargo deny check
• cargo audit
• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.7
• cargo fmt --all -- --check
• cargo check --all-targets
• cargo clippy --all-targets --all-features -- -D warnings
• cargo test
• mdbook build docs
• mdbook test docs
• oranda build
• dist generate --check
• dist plan --output-format=json --no-local-paths

Dependabot vulnerability alerts will be enabled after merge; automated dependency pull requests remain disabled.

Closes #21

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.