test: verify the dependency gate end to end (final)

[ChesterSim]

Verification only against main e039f99. Will be closed, not merged.

[github-actions]

New dependencies in this pull request

This pull request adds packages, or changes where existing packages are
fetched from. Confirm each one's source, maintainer and integrity, then
apply the deps-reviewed label to merge.

Lockfile	Change	Package	Source
tests/fixtures/Cargo.lock	new package	second-crate-added-after-approval	registry+https://crates.example.invalid/index
tests/fixtures/Cargo.lock	new package	totally-legit-crate	registry+https://crates.example.invalid/index

Sign-off covers exactly this set (digest 3f210e9def668811fef223c1). Adding to it
afterwards drops the label and needs a fresh review.

[ChesterSim]

Verification complete against main e039f99; closing without merging.

Step	Head	Digest	Result
1. one crate added	b8dcb4b	9499533cdb4dc53f8b1c92fb	fail — 1 finding(s) need review
2. deps-reviewed applied	same	same	pass — signed off via the 'deps-reviewed' label, marker recorded
3. second crate pushed	26cdc7a	3f210e9def668811fef223c1	fail — applied for a different set of findings, label deleted (0 remaining)

Both dogfood modes passed in the same runs, so pull_request and pull_request_target are both exercised.