ci: audit every tracked Cargo.lock, and bump quinn-proto in the nested lock (RUSTSEC-2026-0185)

[cryptskii]

What changes

• New ci/audit_every_lockfile.sh runs cargo audit -f on every Cargo.lock that git ls-files lists. That is 8 today: root, dsm_client/deterministic_state_machine, dsm-android-anchor, dsm-anchor-hw-verifier, dsm-anchor-bench, dsm-anchor-nonsecure-app, dsm-anchor-pico, tools/dsm_guarded_reference. It audits all of them before failing, and refuses an empty list rather than passing vacuously.
• The CI "Rust gates" security audit, the release workflow's security audit, make audit and make release-preflight call the script instead of root-only cargo audit.
• dsm_client/deterministic_state_machine/Cargo.lock moves quinn-proto 0.11.14 to 0.11.15 (RUSTSEC-2026-0185). It was the only lockfile failing, so the widened gate starts green.

Why

The audit read only the root lockfile. The nested workspace lock is what the test board and make android-libs resolve through, and the dsm-android-anchor lock is what the shipped Android library resolves through. RUSTSEC-2026-0285 (fixed in #887) and RUSTSEC-2026-0185 sat in those locks unreported. The list comes from git, so a new lockfile is audited from the commit that adds it.

Verification

• Positive run: 8 lockfiles, no vulnerabilities, exit 0.
• Negative control: with main's nested lock restored, the script exits 1 and names RUSTSEC-2026-0185 and that lockfile. The bumped lock was put back and compared byte-identical.
• The lockfile diff moves quinn-proto only.
• Both workflow files parse as YAML.
• ci/**, .github/** and **/Cargo.lock are full triggers in ci/layers.toml, so Rust gates runs on this PR.

Warnings (unmaintained, unsound, yanked) stay allowed as before, and the ignores in .cargo/audit.toml apply to every lockfile because each audit runs from the repository root.