chore(tech-debt): phase 2 — cargo-deny + signing/balance unit tests

[tuddman]

Supply-chain controls + targeted unit tests filling the gaps from the 2026-05-26 audit. Drops the dependabot piece per user request.

• deny.toml at workspace root: advisories / bans / licenses / sources policy, ported from arborter/app/deny.toml. Two RUSTSEC ignores carried over (bincode 1.x feature-frozen, paste unmaintained); both apply to the SDK's transitive tree too.
• .github/workflows/security-audit.yml: cargo-deny CI on PR + daily cron, matrix over the four check categories. Mirrors arborter.
• aspens-{cli,repl,admin}: publish = false so cargo-deny's wildcard-path allowance applies to the intra-workspace aspens dep. (These binaries aren't published to crates.io.)
• evm: 2 new envelope-digest tests (length-prefix correctness across byte counts) plus a round-trip sign-and-recover test that proves Wallet::sign_message produces a 65-byte signature whose recovered address matches the signer — exactly what arborter's verify.rs checks. This was the highest-value remaining gap from audit Fix/admin 3 #9.
• commands/trading/balance.rs: 10 new tests for format_balance_with_decimals, format_balance, and select_wallet_for_chain (multi-curve wallet routing — regression guard for the cross-chain order flow).

Re-scoped from the audit during execution:

• Audit Fix/admin 3 #9 ("no unit tests for signing primitives") was substantially wrong; client_parity.rs, orders.rs, gasless.rs, and solana/mod.rs already cover derive_order_id, gasless_lock_signing_hash, and gasless_lock_signing_message with snapshots + parity fixtures. Only the EIP-191 envelope path lacked round-trip recovery coverage.
• Audit further naming convention fixes #11 ("zero tests on balance/deposit/withdraw/cancel_order") was correct on the count, but most of these files are thin gRPC/RPC wrappers whose pure logic (signing, account derivation) is covered elsewhere. The genuine offline-testable seams concentrate in balance.rs (formatters + wallet routing).