ci: add supply-chain and license audit coverage before releases

[ubugeeei]

Problem

The release path has no dependency/license audit step. This matters because the project publishes Rust and npm artifacts.

Acceptance criteria

• Add an auditable policy for Rust and npm dependencies.
• Run the audit in CI or release checks.
• Document how maintainers handle allowlisted advisories or license exceptions.