chore: add full-treatment quality gates

Mirrors the ucobs convention:
- justfile aggregates test-{unit,clippy,fmt,doc,deny,fuzz,miri,mutants}
  behind a single 'just test' target.
- mise.toml pins rust + cargo-{deny,fuzz,mutants,nextest}.
- deny.toml enforces permissive licenses only and bans wildcard /
  unknown-source deps.
- CLAUDE.md captures identity and first principles.
- Cargo.toml adds unsafe_code = forbid and docs.rs all-features metadata.

cargo check (all feature permutations), nextest, clippy with warnings
as errors, fmt check, doc, and deny all pass. fuzz/miri/mutants land
in follow-up commits.

deny.toml

@@ -0,0 +1,31 @@
+[graph]
+all-features = true
+
+[advisories]
+yanked = "deny"
+
+[licenses]
+# Permissive licenses only. All copyleft (GPL, LGPL, AGPL, MPL, etc.) denied by omission.
+allow = [
+    "MIT",
+    "Apache-2.0",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "ISC",
+    "Zlib",
+    "Unlicense",
+    "CC0-1.0",
+    "Unicode-3.0",
+    "Unicode-DFS-2016",
+]
+unused-allowed-license = "allow"
+
+[bans]
+multiple-versions = "warn"
+wildcards = "deny"
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]
+allow-git = []