Fixes ReadinessFlag::subscribe to avoid handing out token 0 or duplicate tokens on i32 wrap-around, adds regression tests, and prevents readiness gates from getting stuck waiting on an unmarkable or mis-authorized token.
- add GitHub workflow running cargo-deny on push/PR - document cargo-deny allowlist with workspace-dep notes and advisory ignores - align workspace crates to inherit version/edition/license for consistent checks
assert_matches is soon to be in std but is experimental for now.
Create an `utils` directory for the small utils crates