refactor: unwrap cleanup + 5-layer supply chain security

.github/workflows/ci.yml

@@ -30,6 +30,12 @@ jobs:
               - 'engine/crates/lex-core/**'
               - 'engine/Cargo.toml'
               - 'engine/Cargo.lock'
+              - 'engine/deny.toml'
+              - 'engine/quarantine-allowlist.toml'
+              - 'engine/build-script-baseline.txt'
+              - 'scripts/check-quarantine.sh'
+              - 'scripts/check-build-scripts.sh'
+              - 'engine/supply-chain/**'
             session:
               - 'engine/crates/lex-session/**'
             ffi:
@@ -137,6 +143,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # needed for quarantine diff against main
 
       - uses: dtolnay/rust-toolchain@stable
 
@@ -148,13 +156,25 @@ jobs:
       - name: Install audit tools
         uses: taiki-e/install-action@v2
         with:
-          tool: cargo-audit,cargo-machete
+          tool: cargo-deny,cargo-vet,cargo-machete
 
-      - uses: jdx/mise-action@v2
-        with:
-          install: false
+      - name: Verify Cargo.lock is in sync
+        run: cd engine && cargo check --locked
+
+      - name: cargo deny (advisories, licenses, sources, bans)
+        run: cd engine && cargo deny check
+
+      - name: cargo vet (audit tracking)
+        run: cd engine && cargo vet check
+
+      - name: Quarantine check (7-day)
+        run: bash scripts/check-quarantine.sh
+
+      - name: build.rs baseline check
+        run: bash scripts/check-build-scripts.sh
 
-      - run: mise run audit
+      - name: Unused dependencies
+        run: cd engine && cargo machete
 
   swift:
     needs: changes