RUST-CI-004: Harden Rust toolchain, feature, and supply-chain gates

[itlezy]

RUST-CI-004 - Harden Rust toolchain, feature, and supply-chain gates

Summary

Make Rust development and release inputs reproducible: pin the current stable
toolchain, exercise the diagnostics feature explicitly, centralize workspace
manifest policy, and enforce dependency source and license rules after obsolete
Git dependencies are removed.

Scope

• Pin Rust 1.97.0 in one repository-owned toolchain file and make CI consume it.
• Declare the workspace Rust version and verify the active compiler in CI.
• Build/check the packet-diagnostics binary without enabling test-only
  egress-audit in product builds.
• Set internal crates non-publishable and use GPL-2.0-only.
• Centralize repeated direct dependencies and narrow Tokio features by crate.
• Enforce Cargo-deny source and license policy after the dependency baseline is
  green; record justified duplicate-version exceptions separately.
• Make maintainability advisories emphasize changed files without becoming
  source-size failures.

Acceptance Criteria

• Local development and every CI job use Rust 1.97.0 from one pin.
• The default daemon, diagnostics binary, and isolated egress-audit test
  configuration each have an explicit gate.
• All internal crates are publish = false and GPL-2.0-only.
• Cargo-deny rejects unapproved Git/registry sources and incompatible
  licenses.
• The repository documents and checks a repeatable toolchain update cadence.
• Policy advisories remain non-failing and prioritize changed files.

Validation

• python tools\rust_quality_gate.py policy
• Supported workspace Rust format, Clippy, build, and test orchestration.
• Cargo-deny advisories, sources, licenses, and the reviewed bans baseline.

[itlezy]

Manifest and supply-chain hygiene landed in granular commits: 1b8e06d (GPL-2.0-only + publish=false), a9c0790 (centralized registry versions), 94a5607 (per-crate Tokio features), and ecc3081 (Cargo-deny advisory/license/source gates with Slint licensing notice). Validation: cargo-deny 0.20.2 reports advisories/licenses/sources OK; all eight Tokio-using packages passed isolated all-target Clippy; the repository quick gate passes. Remaining on this item: explicit packet-diagnostics compilation and change-aware maintainability reporting.