[chore] Supply chain and build hardening

[St4NNi]

Closes #348

Makes builds reproducible, adds supply-chain policy, and brings all dependencies to their latest versions.

Pinning and policy

• Pin craqle by exact rev; pin the toolchain to 1.95.0 (rust-toolchain.toml); pin image bases by digest and iroh-doctor by version; add --locked to CI and Docker builds.
• Add deny.toml (advisories, license allowlist, git-source allowlist) and CI jobs for cargo-deny, ShellCheck, and compose-config; sha-pin all GitHub Actions; least-privilege workflow token.
• Exclude untracked local portal assets from the image build context; bind the development Keycloak to loopback.

Dependency updates

• Compatible bumps with no code impact: iroh and iroh-base to 1.0.2, aws-config 1.9.0, aws-sdk-s3 1.138.0, bytes 1.12.1, crossfire 3.1.19, lru 0.18.1, md5 0.8.1, plus a full lockfile refresh of transitive packages.
• opendal 0.57 to 0.58. The raw backend API was reworked upstream (Access becomes Service; AccessorInfo, OperatorBuilder and finish() are gone), so the service builder and the fault-injection backend used by the blob close-failure tests are adapted to the new trait.
• ulid 1.2 to 2.0. Ulid::new() no longer exists and is replaced by Ulid::gen(), spelled Ulid::r#gen() because gen is a reserved keyword in edition 2024. Display, serde and postcard representations are unchanged, so the HTTP and storage formats are unaffected.
• craqle rev moved to the current upstream main, which changes only craqle's own manifest, lockfile and tests, not its library sources.

ed25519-dalek stays at 2.2.0. iroh declares an exact =3.0.0-rc.0 requirement, which is in the same major-3 compatibility range as ^3.0.0, so cargo cannot select a version that satisfies both and the resolve fails outright. Tracked in #396.

Deployment note

With the .dockerignore change, portal-embed image builds must pass --build-arg PORTAL_EMBED_DIR=<dir outside docker/> (documented at the Dockerfile ARG); the deploy runbook's portal staging step needs updating before the next cluster image rebuild.

irokle stays on branch = main because craqle re-exports its types and a rev-pin would resolve it as a second version; it is pinned in effect via the lockfile plus --locked. A true rev-pin requires an upstream craqle change.