ci: the dependency policy in the gate, and a daily advisory check

The rust gate builds and tests with --locked, so a change that would
move Cargo.lock fails instead of resolving something new. A dependency
policy step runs cargo deny check (licenses, advisories, bans, sources
from deny.toml) and cargo machete, both now in the runner image
(gongfoo bd936d3, images run 284). deps.yaml runs the advisory check
daily on the rust runner, so an advisory published against a
dependency the lockfile already pins turns red within a day whether or
not anyone pushes.

Closes #49

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014ftBXYuba8ARhQeF74oUgW

.gitea/workflows/ci.yaml

@@ -35,11 +35,24 @@ jobs:
           pnpm build
 
       - name: rust gate
+        # --locked: a build that would change Cargo.lock fails rather than
+        # quietly resolving something new (#49).
         run: |
           set -euo pipefail
           cargo fmt --check --all
-          cargo clippy --workspace --all-targets -- -D warnings
-          cargo test --workspace
+          cargo clippy --locked --workspace --all-targets -- -D warnings
+          cargo test --locked --workspace
+
+      - name: dependency policy
+        # deny.toml: licenses, advisories, bans and sources; machete: crates
+        # declared and never used. Both ship in the runner image (gongfoo
+        # runner-rust). The daily run in deps.yaml catches an advisory
+        # published against an unchanged lockfile (#49).
+        run: |
+          set -euo pipefail
+          cargo deny --version
+          cargo deny check
+          cargo machete
 
       - name: rust talks to the webview through one file
         # `ui/src/api/wallet.ts` is the only module allowed to import Tauri's

.gitea/workflows/deps.yaml

@@ -0,0 +1,25 @@
+name: deps
+
+# The advisory half of the dependency policy on a clock (#49). CI runs the
+# full policy on every push; this runs the advisory check daily, so a
+# RustSec advisory published against a dependency this repository already
+# pins turns red within a day even when nobody pushes.
+
+on:
+  schedule:
+    - cron: "17 5 * * *"
+  workflow_dispatch:
+
+jobs:
+  advisories:
+    # `rust`: cargo-deny ships in the image; no GTK is needed to read a
+    # lockfile against the advisory database.
+    runs-on: rust
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: advisories against the pinned lockfile
+        run: |
+          set -euo pipefail
+          cargo deny --version
+          cargo deny check advisories