ci: adopt org workflow & supply-chain standards

[electricapp]

Brings power-monitor into line with the electricapp workflow standard
(electricapp/ccaudit:.github/WORKFLOW_STANDARDS.md, §13 power-monitor row).
All changes are additive/surgical — the existing fmt/build/msrv jobs and their
macOS IOReport-gated logic are preserved verbatim.

Hardening (ci.yml)

• Top-level permissions: {} (deny-all); every job re-grants contents: read
  (audit also gets checks: write for rustsec/audit-check).
• persist-credentials: false on every checkout.
• timeout-minutes added to every job (fmt 10, build/msrv 30, lint lanes 5–10).

Supply chain

• New root deny.toml (license allowlist, bans multiple-versions=warn /
  wildcards=deny, crates.io-only sources, advisories yanked=deny) — copied
  from the ccaudit template with the ccaudit-specific exceptions stripped.
• New deny (cargo-deny-action) + audit (rustsec/audit-check) jobs in ci.yml.
• New .github/workflows/supply-chain.yml: scheduled (Mon 07:17 UTC) +
  workflow_dispatch re-audit of the committed lockfile, RUST_TOOLCHAIN=1.96.0
  to match the declared MSRV.

CI coverage

• New typos (crate-ci/typos) and unused-deps (cargo-machete via
  taiki-e/install-action) jobs.
• New actionlint job (SHA-pinned v1.7.12 download + sha256 verify, then
  ./actionlint).

Pinning

• All new actions pinned to the standard's canonical SHAs (# tag comments).
• Kept the existing dtolnay @e97e2d8c… # v1 (with toolchain: inputs) and
  Swatinem @c19371144… # v2.9.1 pins — both already match / are accepted by
  the standard.

Governance

• New .github/settings.json + .github/apply-settings.sh (slug
  electricapp/power-monitor, branch main, environments: [] — repo ships no
  artifacts today). Required-check contexts: rustfmt, clippy + test + doc,
  msrv (1.96), cargo-deny, cargo-audit, typos, cargo-machete,
  actionlint.

Follow-ups (post-merge, manual)

• Run .github/apply-settings.sh once an admin merges, to reconcile branch
  protection / merge policy / security settings (it asserts no drift).
• dependabot.yml left as-is (already daily + limit 99 + proper labels; the
  standard's grouping is optional and not in the power-monitor checklist row).