#49 CI/supply-chain: cargo audit, Dependabot, release gate, pin tauri-plugin-mcp

[Anonymous]

Originally created by: kristofferR

• No `cargo audit`/`cargo-deny` and no Dependabot/Renovate anywhere — add `cargo audit` to `ci.yml` and a `dependabot.yml` covering cargo + github-actions.
• `tauri-plugin-mcp` is an unpinned git dependency (`Cargo.toml`) — pin to a rev.
• `release.yml` has no lint/test gate: a tag on an unverified commit ships to all 6 targets. Add a check job the build matrix `needs`.

[Anonymous]

Originally posted by: kristofferR

Done in [#60]: weekly + per-push cargo audit job (with documented quick-xml ignores in .cargo/audit.toml), Dependabot for cargo/github-actions/npm (already filed its first PRs: [#66]–69), tauri-plugin-mcp pinned to a rev, and a fmt/clippy/test/syntax gate in front of the release build matrix.

[Anonymous]

Ticket changed by: kristofferR

• status: open --> closed