chore: enforce shared workspace dependencies via cargo-deny (#8670)