fix(ci): run pinned native dependency and repository secret scans

[rldyourmnd]

Summary

Dependency and repository secret checks can fail before cargo-deny starts because the container action pulls an anonymous Docker Hub image. RDS run37991598359 and its second attempt both hit HTTP429. Run the same cargo-deny0.20.2 natively through the already pinned taiki installer, whose immutable manifest contains platform-specific archive hashes. Preserve job names, runner selection, working-directory/argument inputs and all check categories.

The adapter parses input strings into argv with shlex and executes cargo directly. Executable probes preserve exit0 and exit37, quoted path boundaries and literal shell metacharacters, and refuse malformed quoting before cargo runs. The real pinned binary passed the Rust fixture and RDS policy locally.

Type of change

• Fix to an existing workflow
• Hardening / security posture improvement

Threat-model note

The deny job now runs natively on the caller-selected runner, like audit/machete. No Docker credentials, login, registry mirror or new secret is introduced. The self Gitleaks caller selects the existing Linux/X64 archive size/hash allowlist; the reusable default and external callers remain unchanged. Checkout remains unprivileged with credentials disabled; action SHAs and cargo-deny version are fixed. The existing install-action checksum manifest binds the downloaded archive. Inputs enter env and are parsed as argv, never evaluated as shell. Toolchain selection now also applies to deny; its setup cache is disabled. No caller input, permission, check name or output is removed.

Permissions diff

Top level remains {}. Deny/audit/machete remain contents: read; no added scopes.

Validation

Actionlint and token-backed pinned zizmor passed. Real cargo-deny0.20.2 checks passed on the fixture and consuming RDS tree. Core and correctly scoped touched validation pass. The complete aggregate, including calendar and live anchor checks with a read token, passed atdb24412. The last self-scan selection passed its secret-scan contract, actionlint and online security review. Generated docs were regenerated with no resulting byte changes; catalog/tool ownership and the example were updated.

The first aggregate run exposed local fixture assumptions: temporary Git commits inherited a user hook, and the renderer fixture's restricted PATH hid macOS jq/sha256sum. Isolate only the synthetic Git environment and bind real renderer prerequisites; keep user configuration and production Git hooks unchanged. Two expired runner facts surfaced in the touched/catalog check and were reverified against current GitHub billing, larger-runner eligibility and self-hosted documentation. Remove the vague eligible-plans wording, keep execution versus storage costs separate, and stagger expiries. The complete aggregate now passes.

Checklist

• Actions use immutable full SHA pins
• Least privilege and checkout credential policy preserved
• Existing timeouts and caller runner choices preserved
• No input expressions embedded into run scripts
• Actionlint and token-backed zizmor pass
• Catalog, caller example, generated docs and Unreleased changelog reviewed
• Commits signed and signed off; Conventional Commits

Tier impact

• Public
• Private free
• Private paid

Runtime fixture run37993452344 passed all three Rust supply-chain jobs, including native cargo-deny. The repository Gitleaks job also hit Docker Hub429 before scanning, so its self-caller now selects the existing digest-verified binary mode at the same version/history scope. Unchanged commitlint container fixtures have their separately retained registry-limit failures; this PR does not claim those unrelated runs passed.