Add ci.yml (compile/fmt/lint/test/audit/machete), nightly.yml (geiger unsafe audit), deny.toml (license/ban/source policy), and Justfile with pre-commit, prepush, ci, and install-hooks recipes.