Add production tooling gates

[johnny-emp]

Summary

• make clippy pass across the workspace with -D warnings, including current needless borrow/as_deref warnings
• add explicit local gates for correctness, benchmarks, and supply-chain review
• wire fmt, clippy, and cargo-deny into CI and the production-readiness gate
• document the expected local quality commands and the local rationale policy for too_many_arguments
• update rand and pprof to clear current advisories surfaced by cargo deny

Verification

• cargo fmt --check
• cargo clippy --workspace --all-targets -- -D warnings
• ./scripts/supply_chain_gate.sh
• cargo test --lib
• git diff --check