[27Bslash6]

Sets up the crate and the CI that every later change builds on.

• A binary crate cachekit-cli (edition 2021) that prints its version, with one integration test that runs the built binary.
• ci.yml on GitHub-hosted ubuntu-latest and macos-latest, for pull requests and pushes to main. Actions are pinned to commit SHAs and the token is read-only.
  • checks (Linux): admin API grep over the source, the crates.io-only step, cargo-deny, rustfmt, and clippy with -D warnings.
  • test (Linux and macOS): cargo test --locked, a release build, and the admin API grep over the release binary.
• Dependencies come from crates.io only. deny.toml denies git sources and unknown registries, and wildcards = "deny" rejects versionless path dependencies. cargo-deny cannot see two further routes, so a CI step closes them: any committed .cargo/config or .cargo/config.toml, which could replace the crates.io source, and any path dependency outside the workspace that declares a version. Only the MIT licence is allowed until a dependency needs another.
• The admin API gate fails the job on any case-insensitive match of /api/admin|platform-admins|flagship. A grep error, such as a missing binary, also fails the job, so an error can never pass as a clean result.

A deliberate-hit commit on this branch proved the gate fails, and a later commit removed it. The run links are in the comment below. Squash-merge so the proof commits stay out of main.

[27Bslash6]

Gate proof. The two test: commits add a deliberate /api/admin reference, and the third removes it. The branch head matches a9f6875 exactly.

Head	Result
a9f6875	all green
3384ed1, hit in the printed output	red: the source grep fails checks. test fails earlier, at its own output assertion, so the binary grep never ran
bc49432, hit kept alive with black_box	red: the source grep fails checks, and the binary grep fails test on Linux and macOS
8ca1ed3, hit removed	all green

cargo-deny was checked locally against the same deny.toml. A git dependency fails sources (source-not-allowed), and a path dependency outside the crate fails bans (wildcard).

Squash-merge this PR so the proof commits stay out of main.