feat(ci): adopt cargo-audit workflow for dependency vulnerability scan

Echidnabot just landed cargo-audit (commit f307fb0); echidna is the
larger Rust workspace and arguably needs it more (113 prover backends
each with their own crate-tree leaves). Adopt the same workflow
verbatim — runs on push/PR + weekly Monday 06:00 UTC against RustSec.

Pairs with the existing dependabot wiring; gives two independent
paths from advisory → fix.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/cargo-audit.yml

@@ -0,0 +1,44 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+#
+# cargo-audit.yml — Dependency vulnerability scanning for Rust projects.
+# Runs cargo-audit against the RustSec advisory database.
+name: Cargo Audit
+
+on:
+  pull_request:
+    branches: ['**']
+  push:
+    branches: [main, master]
+  schedule:
+    # Run weekly on Monday at 06:00 UTC to catch new advisories.
+    - cron: '0 6 * * 1'
+
+permissions:
+  contents: read
+
+jobs:
+  audit:
+    name: Dependency audit
+    runs-on: ubuntu-latest
+    if: hashFiles('Cargo.lock') != ''
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
+
+      - name: Install cargo-audit
+        run: cargo install cargo-audit --locked
+
+      - name: Run cargo audit
+        run: cargo audit
+
+      - name: Write summary
+        if: always()
+        run: |
+          echo "## Cargo Audit Results" >> "$GITHUB_STEP_SUMMARY"
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+          cargo audit 2>&1 | tail -20 >> "$GITHUB_STEP_SUMMARY" || true