CI - Add cargo ci dep-check and remove unused deps

[clockwork-labs-bot]

Description of Changes

Adds cargo ci dep-check, stacked on #5687, to run cargo-machete from the repository root.

The command forwards any extra arguments to cargo-machete, so manual runs can use flags like --with-metadata or pass explicit paths.

The Lints workflow installs cargo-machete with --locked and runs cargo ci dep-check after cargo ci lint.

API and ABI breaking changes

None.

Expected complexity level and risk

1. This is a small CI-tooling wrapper.

Testing

• cargo run -p ci -- self-docs
• cargo fmt --manifest-path tools/ci/Cargo.toml --all -- --check
• cargo check -p ci -p ci-dep-check
• cargo clippy -p ci -p ci-dep-check -- -D warnings
• cargo run -p ci -- self-docs --check
• cargo run -p ci -- dep-check -- --help
• git diff --check

Note: cargo run -p ci -- dep-check now performs an unrestricted full-repo machete scan. In this branch it reports existing repository-wide findings and a template workspace load error, so I did not use a clean full run as a passing verification step.

[bfops]

note for human reviewers: templates can't depend on workspace versions because they're specifically designed to be copied out of the workspace for users by the CLI