chore(tooling): migrate lint to cargo-deny 0.20

[staging-devin-ai-integration]

Context

cargo-deny 0.20 moved --metadata-path from the check subcommand to the
root command. StreamKit currently uses:

cargo deny check licenses --metadata-path target/cargo-metadata.json

That command exits with code 2 on cargo-deny 0.20.2, including during Devin
snapshot maintenance. The environment blueprint is temporarily pinned to
cargo-deny 0.19.9.

The equivalent 0.20 syntax is:

cargo deny --metadata-path target/cargo-metadata.json check licenses

This was verified against cargo-deny 0.20.2; the license check completes with
licenses ok.

Scope

• Update the lint-skit recipe to use the 0.20 CLI syntax.
• Pin or otherwise document the supported cargo-deny version in CI and
  contributor setup so local, CI, and snapshot environments are reproducible.
• Remove the temporary 0.19.9 pin from the Devin environment blueprint after
  the repository change lands.

Acceptance criteria

• cargo-deny 0.20.2 successfully runs the metadata-backed license check.
• just lint-skit passes with the supported 0.20 release.
• CI and contributor documentation use a compatible, reproducible install.

Written by Devin