Gate Rust dead-code Cargo execution behind command trust

[alxxjohn]

Motivation

• The Rust toolchain dead-code path previously invoked cargo check based solely on repository config, allowing untrusted PRs to run build scripts or proc-macros and potentially exfiltrate secrets.
• The change enforces the established operator opt-in policy for config-driven command execution so scans do not run untrusted toolchain commands by default.

Description

• Add a trust gate by calling trust.GuardConfigCommand("quality_rules.dead_code", "cargo check") in rustToolchainDeadCodeFindings, and return a diagnostic when command execution is denied.
• Add a regression test TestRustToolchainDeadCodeRequiresConfigCommandTrust in quality_rust_toolchain_dead_code_test.go that verifies the default-deny policy produces the expected trust diagnostic.

Testing

• ✅ go test ./internal/codeguard/checks/quality (unit tests for the modified package passed).
• ✅ go test ./... (full test suite in the repository completed successfully).
• ✅ gofmt -w internal/codeguard/checks/quality/quality_rust_toolchain_dead_code.go internal/codeguard/checks/quality/quality_rust_toolchain_dead_code_test.go (formatting applied with no issues).
• ✅ git diff --check (no whitespace or diff errors reported).

---

Codex Task