ci(rust): add cargo-audit / RUSTSEC advisory gate to reusable rust.yml (shared-fate) #432

Add a cargo-audit / RUSTSEC advisory gate to the reusable rust.yml (shared-fate)

The reusable .github/workflows/rust.yml currently has a Clippy step
("Clippy (deny warnings)") but no advisory gate — verified 2026-07-20, no
cargo audit / cargo deny advisories / RUSTSEC step present.

Why this is shared-fate

Every estate repo that consumes this reusable rust.yml inherits (or fails to
inherit) the gate. Fixing it here fixes it everywhere at source.

Scope

Add a step that runs the real cargo audit (or cargo deny advisories) so
RUSTSEC advisories fail CI.

Note on advisories (do not hardcode)

A prior run (2026-07-17, session aa0b2861) observed cargo audit flagging
crossbeam-epoch 0.9.18 (RUSTSEC-2026-0204) and an anyhow unsoundness
(RUSTSEC-2026-0190). Re-run cargo audit for the current advisory set — the
gate reports live findings; these are only a pointer, not a fixed list.

Acceptance (no handwaving)

• The gate runs the actual cargo audit tool (not a proxy).
• Verified green in live CI (or the surfaced advisories triaged/patched).

Tracked from a session handoff (2026-07-20). Follow-up from the estate
dead-workflow sweep (ref gitbot-fleet#374/#375).