ci(deps): fix red cargo-deny gate — run natively, drop stale license allow

.github/workflows/ci.yml

@@ -58,10 +58,21 @@ jobs:
       - run: cargo fmt --check
 
   deny:
+    name: Cargo Deny (advisories/licenses/bans/sources)
     runs-on: ubuntu-latest
+    # Native install rather than the Docker-based cargo-deny-action: the action
+    # builds a container from a Docker Hub base image at runtime, which is rate-
+    # limited/flaky from GitHub Actions and made this gate red on a transient
+    # registry timeout. Mirrors the `vet` job below (taiki-e/install-action).
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-      - uses: EmbarkStudios/cargo-deny-action@3fd3802e88374d3fe9159b834c7714ec57d6c979 # v2
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Install cargo-deny
+        uses: taiki-e/install-action@59012be0884e296ca2da49b530610e72c49039ad # v2.81.6
+        with:
+          tool: cargo-deny
+      - name: Check dependency hygiene
+        run: cargo deny check
 
   vet:
     name: Cargo Vet (supply-chain)

deny.toml

@@ -7,7 +7,6 @@ allow = [
     "MIT",
     "Apache-2.0",
     "Unicode-3.0",
-    "Unicode-DFS-2016",
 ]
 confidence-threshold = 0.8