ci: standardize CI workflows and git hooks

Add ci.yml (compile/fmt/lint/test/audit/machete), nightly.yml (geiger
unsafe audit), deny.toml (license/ban/source policy), and Justfile with
pre-commit, prepush, ci, and install-hooks recipes.

deny.toml

@@ -0,0 +1,30 @@
+[advisories]
+ignore = []
+
+[licenses]
+allow = [
+  "MIT",
+  "Apache-2.0",
+  "Apache-2.0 WITH LLVM-exception",
+  "BSD-2-Clause",
+  "BSD-3-Clause",
+  "ISC",
+  "Unicode-3.0",
+  "Unicode-DFS-2016",
+  "Zlib",
+  "MPL-2.0",
+  "CC0-1.0",
+]
+confidence-threshold = 0.8
+
+[licenses.private]
+ignore = false
+
+[bans]
+multiple-versions = "warn"
+wildcards = "allow"
+
+[sources]
+unknown-registry = "warn"
+unknown-git = "warn"
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]