CI: pinned actions, cargo deny, fuzz smoke; build-android.sh works on Linux

- deny.toml: allow-wildcard-paths for the workspace's own path crates; ignore two
  unmaintained notices for uniffi 0.28's build-time deps (bincode, paste).
- build-android.sh ran uniffi-bindgen on libkv_ffi.dylib, which doesn't exist on the
  Linux CI runner; pick .so there.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

deny.toml

@@ -2,6 +2,13 @@
 [advisories]
 version = 2
 yanked = "deny"
+ignore = [
+  # Unmaintained (no known vulnerability), build-time only: pulled in by uniffi 0.28's proc-macros and
+  # bindgen, never linked into the shipped library's runtime paths. Goes away with a uniffi upgrade,
+  # which regenerates the Swift/Kotlin bindings (tracked in fuzz/README.md "Dependency policy").
+  { id = "RUSTSEC-2025-0141", reason = "bincode 1.x via uniffi_macros 0.28 (build-time)" },
+  { id = "RUSTSEC-2024-0436", reason = "paste via uniffi_core/uniffi_bindgen 0.28 (proc-macro)" },
+]
 
 [licenses]
 version = 2
@@ -13,6 +20,8 @@ confidence-threshold = 0.9
 [bans]
 multiple-versions = "warn"
 wildcards = "deny"
+# The workspace's own crates are path dependencies without a version; they are never published.
+allow-wildcard-paths = true
 
 [sources]
 unknown-registry = "deny"