fix(ci): correct cargo-deny flag order; clear RUSTSEC advisories

cargo-deny takes --exclude-dev before the subcommand; the audit job
passed it after `check` and died on argument parsing, so the audit
never actually ran. With it running, two advisories fail the build:
RUSTSEC-2026-0204 (crossbeam-epoch 0.9.18 null-pointer deref in
fmt::Display) and RUSTSEC-2026-0186 (memmap2 0.9.10 unchecked pointer
offset). Lockfile bumped to crossbeam-epoch 0.9.20 and memmap2 0.9.11
per the advisories' guidance.

Author: mkhairi

.github/workflows/test.yml

@@ -266,4 +266,4 @@ jobs:
         with:
           tool: cargo-deny
       - name: Run cargo-deny
-        run: cargo deny check --exclude-dev
+        run: cargo deny --exclude-dev check