Make cargo_audit and cargo_deny run, and triage what they found
Split assumption substitution out of docengine into subst + mnw-assumptions