[codex] Harden project validation baseline

[SCP-008-1]

Summary

• pin the repository Rust toolchain and align CI/release validation
• apply workspace metadata, dependencies, and lint policy consistently to the protocol crate
• deny unsafe Rust, remove an unused E2E dependency, and simplify the lockfile
• add focused Make targets for formatting, linting, tests, wasm checks, and full validation
• remove the external Google Fonts request and restrict local proxy CORS
• clean up compiler warnings in touched protocol and rendering code

Why

Local development, CI, and release builds should use the same explicit validation baseline. The workspace also needs clearer privacy and dependency boundaries so routine validation does not rely on unnecessary external requests or stale development packages.

Validation

• cargo fmt --all -- --check
• cargo test --workspace
• cargo clippy --workspace --all-targets
• cargo check --workspace --target wasm32-unknown-unknown

All commands passed locally using Rust 1.97.1. Clippy still reports existing non-blocking warnings outside the focused cleanup in this change.

Notes

• The repository pins Rust 1.96.0; local validation used the already installed 1.97.1 toolchain because the local 1.96.0 installation encountered a rustup recovery conflict.
• No private captures, credentials, runtime dumps, generated build output, or third-party runtime assets are included.

Closes #3