ci: fold the license check into the audit job via cargo-deny

Restores the dependency license check that went away with the copyright
job, this time as a gate rather than a report. Every dependency is
statically linked into GPL-3.0-or-later binaries, so each one has to
carry a GPL-3.0-compatible license, and the alternative to checking is
hearing about it from a distribution packager after release.

cargo-deny covers advisories as well, so it replaces cargo-audit
outright and the two jobs become one. Verified equivalent on the
advisory side: against the lock this branch carried before 64967a7, it
reports RUSTSEC-2026-0204 on crossbeam-epoch 0.9.18 and exits non-zero,
which is what cargo audit did.

Pin unmaintained, unsound, and yanked in the config rather than
inheriting them. cargo-deny defaults unsound to the workspace alone and
yanked to a warning, both looser than the cargo audit --deny warnings
the job ran until now; stating all three keeps a later cargo-deny
upgrade from relaxing the gate without anyone noticing.

The allow list holds only what the current tree needs. BSD-3-Clause and
Unicode-3.0 each look droppable but sit inside AND expressions, where
the permissive alternative cannot satisfy the requirement alone.
cargo-deny reports an allowance nothing matches, so an entry that stops
being needed will say so.

Name the config .deny.toml. cargo-deny looks for deny.toml, .deny.toml,
then .cargo/deny.toml, so the dotfile needs no --config flag and matches
how .rustfmt.toml and .codespellrc already sit in the tree.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: rizsotto

.deny.toml

@@ -0,0 +1,36 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+# Every dependency is statically linked into GPL-3.0-or-later binaries,
+# so each one has to carry a GPL-3.0-compatible license. CI gates on
+# this because the alternative is finding out from a distribution
+# packager, after release, that the linked result cannot be shipped.
+#
+# The list is deliberately minimal: each entry is load-bearing for the
+# current tree, and cargo-deny reports any allowance nothing matches, so
+# a stale entry does not sit here unnoticed. A dependency that needs a
+# new entry is a decision worth making explicitly rather than a default
+# worth inheriting.
+[licenses]
+allow = [
+    "MIT",
+    "Apache-2.0",
+    # Both of these appear only inside AND expressions, where the
+    # permissive alternative cannot satisfy the requirement on its own:
+    # encoding_rs is "(Apache-2.0 OR MIT) AND BSD-3-Clause", and
+    # unicode-ident is "(MIT OR Apache-2.0) AND Unicode-3.0".
+    "BSD-3-Clause",
+    "Unicode-3.0",
+    # Bear's own crates. Nine of the eleven are publishable, so they are
+    # part of the graph cargo-deny walks.
+    "GPL-3.0-or-later",
+]
+
+# Stated rather than inherited. These three carry the whole weight of the
+# advisory gate, and two of cargo-deny's defaults are looser than what
+# this job enforced when it ran cargo-audit: unsound defaults to the
+# workspace only, and yanked to a warning. Pinning them keeps a
+# cargo-deny upgrade from quietly relaxing the gate.
+[advisories]
+unmaintained = "all"
+unsound = "all"
+yanked = "deny"

.github/workflows/build_rust.yml

@@ -85,8 +85,8 @@ jobs:
       - name: Run Codespell
         run: codespell
 
-  security-audit:
-    name: Security Audit
+  audit:
+    name: Audit
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
@@ -95,6 +95,6 @@ jobs:
           toolchain: stable
       - uses: taiki-e/install-action@v2
         with:
-          tool: cargo-audit
-      - name: Run Cargo Audit
-        run: cargo audit --deny warnings
+          tool: cargo-deny
+      - name: Run Cargo Deny
+        run: cargo deny check advisories licenses