fix(ci): unbreak Stability cargo-deny job (+ in-flight next work)

.github/workflows/stability.yml

@@ -102,4 +102,16 @@ jobs:
       - uses: actions/checkout@v6
       - name: Checkout Reflective sibling dependencies
         run: bash scripts/ci/checkout-reflective-siblings.sh
-      - uses: EmbarkStudios/cargo-deny-action@v2
+      # Not EmbarkStudios/cargo-deny-action: its docker container can't
+      # install the repo's pinned musl toolchain and doesn't see the
+      # sibling checkouts, so `cargo metadata` fails on converge-core.
+      # Run cargo-deny in the runner env like the audit job above.
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: ${{ env.RUST_VERSION }}
+      - uses: Swatinem/rust-cache@v2
+      - uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-deny
+      - name: Run cargo-deny
+        run: cargo deny check