Replace unverified cargo-deny action with checksum-verified install

[Copilot]

This updates the CI workflow to remove the flagged unverified GitHub Action usage behind alert #74. The cargo deny job now installs a pinned cargo-deny release directly and verifies the archive checksum before execution.

• Workflow hardening

  • Remove EmbarkStudios/cargo-deny-action from .github/workflows/check.yaml
  • Keep the existing deny job behavior, but execute it via a locally installed pinned binary

• Verified tool installation

  • Add an explicit CARGO_DENY_VERSION
  • Download the matching release asset for the runner architecture
  • Verify the archive with a pinned SHA-256 before extracting cargo-deny
  • Run cargo deny check --all-features directly

• Policy cleanup

  • Remove the now-unused poutine allowlist entry from .github/poutine.yml

- name: Install cargo-deny
  run: |
    curl --proto '=https' --tlsv1.2 --silent --show-error --location \
      --output "${archive_path}" \
      "https://github.com/EmbarkStudios/cargo-deny/releases/download/${CARGO_DENY_VERSION}/${asset}"

    echo "${sha256}  ${archive_path}" | sha256sum -c -
    tar -xzf "${archive_path}" -C "${HOME}/.cargo/bin" --strip-components=1 "${asset%.tar.gz}/cargo-deny"