ci(cp): make the openab-cp proto-only dependency leak check complete and fail closed #1589

Follow-up from the round-3 review of #1588 (finding F1): #1588 (comment)

Problem

The openab-cp (proto only, no default features) step in the check job of .github/workflows/ci.yml checks the proto-only dependency graph with:

leaked=$(cargo tree -p openab-cp --no-default-features -e normal --prefix none \
  | grep -E '^(tokio|axum|hyper|tower|tracing|clap|toml) ' || true)

This can miss a leak in two ways:

1. Incomplete denylist. The server feature also gates futures-util, anyhow, parking_lot and subtle. A leak of any of these is not matched. (tracing-subscriber is covered indirectly because it depends on tracing.)
2. Fails open. || true also swallows a failing cargo tree under pipefail. If cargo tree errors or its output format changes, leaked is empty and the step passes without checking anything.

Today all ten server dependencies are optional = true, so there is no current leak. This is a CI false-negative gap.

Proposed fix

• Capture the cargo tree output without || true, so a cargo tree failure fails the step.
• Fail if the output is empty.
• Compare package names against an allowlist (the normal-dependency closure of serde, serde_json and chrono), or at minimum add futures-util|anyhow|parking_lot|subtle|tracing-subscriber to the denylist.

Acceptance criteria

• Making any one server dependency non-optional makes the step fail.
• A failing or empty cargo tree makes the step fail.
• The current head still passes.