test(ci): self-test rust/base and the security workflows

[ob-aion]

Summary

• Self-test rust/base end-to-end on a Rust fixture crate (test/fixtures/rust-crate): stage it at the workspace root, run the composite, let its own fmt / clippy / test gate it.
• Wire the security-gate.yml and security.yml reusable workflows into self-security via local ./ refs — testable now that v0 carries the security composites (released in 0.2.0).

Test plan

• rust-base (self-actions): rust/base installs the toolchain and runs fmt / clippy / test on the fixture, green.
• security-gate / security (self-security): the reusable workflows run via ./ (gate routes to osv + gitleaks; advisory runs dependency-review), green.
• javascript-base still green.