ci: run cargo deny on the cutile-rs workspace #1620

Summary

cutile-rs/deny.toml is never executed. The Oxide cargo-deny job and just check-guards check the host workspace, the SIMT workspace, rustc-codegen-cuda, the device-only fixture, and the example workspaces. They skip cutile-rs because that tree has its own policy file, and nothing else runs cargo deny against it.

An advisory in cutile-rs/Cargo.lock therefore cannot fail CI. RUSTSEC-2026-0386 (#1618) was in that lock and only showed up because the example-policy job happened to hit the same crate elsewhere.

Change

Run cargo deny --manifest-path cutile-rs/Cargo.toml --locked check from the cargo-deny workflow and from just check-guards. A walk that starts at cutile-rs/Cargo.toml finds cutile-rs/deny.toml before the root policy.

The paper benchmark locks under cutile-rs/cutile-benchmarks/paper stay out. They are separate workspaces, and launch_overhead_rust patches its dependencies to a path outside this tree.

This check fails on current main until #1619 moves cutile-rs tokio to 1.54.1.