Add cargo-deny plugin

cargo-deny audits Rust dependency trees for security advisories, license
policy, duplicate versions, and untrusted sources.

- Uses the static musl Linux build; macOS and Windows use the upstream
  release archives (Windows ships x86_64 only)
- Verifies every download against its published .sha256
- Tags are bare semver, so no version-pattern is needed
- The binary nests inside a versioned directory, reflected in exe-path

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T2Rwh4XwFE3cR9oHCc7T89

Author: jleibs

.prototools

@@ -2,6 +2,7 @@ actionlint = "1.7.12"
 atlas = "1.2.3"
 blender = "4.5.11"
 buf = "1.71.0"
+cargo-deny = "0.19.9"
 claude = "2.1.191"
 cloud-provider-kind = "0.10.0"
 cwic = "1.33.0"
@@ -28,6 +29,7 @@ actionlint = "file://./actionlint/plugin.toml"
 atlas = "file://./atlas/plugin.toml"
 blender = "file://./blender/plugin.toml"
 buf = "file://./buf/plugin.toml"
+cargo-deny = "file://./cargo-deny/plugin.toml"
 claude = "file://./claude/plugin.toml"
 cloud-provider-kind = "file://./cloud-provider-kind/plugin.toml"
 cwic = "file://./cwic/plugin.toml"

cargo-deny/README.md

@@ -0,0 +1,13 @@
+# cargo-deny plugin
+
+[cargo-deny](https://github.com/EmbarkStudios/cargo-deny) plugin for [proto](https://github.com/moonrepo/proto).
+
+## Installation
+
+cargo-deny is not built into proto, so register this plugin, pin a version, then install:
+
+```shell
+proto plugin add cargo-deny "https://raw.githubusercontent.com/Genesis-Embodied-AI/proto-plugins/main/cargo-deny/plugin.toml"
+proto pin cargo-deny latest --resolve
+proto install cargo-deny
+```

cargo-deny/plugin.toml

@@ -0,0 +1,27 @@
+name = "cargo-deny"
+type = "cli"
+
+[resolve]
+git-url = "https://github.com/EmbarkStudios/cargo-deny"
+
+# Release tags are bare semver (e.g. 0.19.9), so no version-pattern is needed and
+# the download URL uses {version} directly. Each archive nests the binary inside
+# a versioned directory. Upstream ships only x86_64 for Windows.
+[platform.linux]
+download-file = "cargo-deny-{version}-{arch}-unknown-linux-musl.tar.gz"
+checksum-file = "cargo-deny-{version}-{arch}-unknown-linux-musl.tar.gz.sha256"
+exe-path = "cargo-deny-{version}-{arch}-unknown-linux-musl/cargo-deny"
+
+[platform.macos]
+download-file = "cargo-deny-{version}-{arch}-apple-darwin.tar.gz"
+checksum-file = "cargo-deny-{version}-{arch}-apple-darwin.tar.gz.sha256"
+exe-path = "cargo-deny-{version}-{arch}-apple-darwin/cargo-deny"
+
+[platform.windows]
+download-file = "cargo-deny-{version}-x86_64-pc-windows-msvc.tar.gz"
+checksum-file = "cargo-deny-{version}-x86_64-pc-windows-msvc.tar.gz.sha256"
+exe-path = "cargo-deny-{version}-x86_64-pc-windows-msvc/cargo-deny.exe"
+
+[install]
+download-url = "https://github.com/EmbarkStudios/cargo-deny/releases/download/{version}/{download_file}"
+checksum-url = "https://github.com/EmbarkStudios/cargo-deny/releases/download/{version}/{checksum_file}"