max / makenotwork

Sanction the quasi git dependency the spike added cargo_deny's sources check is deny-by-default on git remotes and allowed only docengine. The G1 spike took four quasi crates as git deps and nothing allowlisted them, so the first Sando build to carry them failed on a supply-chain gate with everything else green. Invisible on a dev box, for the reason the surrounding comment already gives: ~/Code/.cargo/config.toml patches these URLs to local checkouts, so cargo deny run from here sees path dependencies and reports sources ok. The Sando worktree inherits no patch. When the two disagree the gate is right.