fix(ci): fix taplo formatting and skip .cargo dir in workspace check

taplo.toml and deny.toml were using 2-space indent; taplo requires tabs.
check-workspace.py now skips .cargo the same way it skips target/ —
prevents 1000+ registry crates from being flagged as missing from workspace
when GitLab cache restores .cargo into the project directory.

.config/taplo.toml

@@ -6,8 +6,8 @@ exclude = [
 	"**/testing/**",
 	"**/zombienet/**",
 	"**/zombienet_tests/**",
-	"target/**",
 	".cargo/**",
+	"target/**",
 ]
 
 # global rules

.github/scripts/check-workspace.py

@@ -66,6 +66,8 @@ def get_crates(workspace_dir, exclude_crates) -> dict:
 	for root, _dirs, files in os.walk(workspace_dir):
 		if "target" in root:
 			continue
+		if ".cargo" in os.path.relpath(root, workspace_dir).split(os.sep):
+			continue
 		for file in files:
 			if file != "Cargo.toml":
 				continue

deny.toml

@@ -3,9 +3,9 @@
 
 [graph]
 targets = [
-  { triple = "wasm32-unknown-unknown" },
+	{ triple = "wasm32-unknown-unknown" },
-  { triple = "x86_64-unknown-linux-gnu" },
+	{ triple = "x86_64-unknown-linux-gnu" },
-  { triple = "x86_64-unknown-linux-musl" },
+	{ triple = "x86_64-unknown-linux-musl" },
 ]
 # all-features prevents krates 0.20+ from panicking with "unable to locate std"
 # on workspace crates that have a std feature but don't enable it by default.
@@ -20,36 +20,36 @@ yanked = "warn"
 # Track via quarterly review instead of blocking CI.
 unmaintained = "none"
 ignore = [
-  # ── wasmtime ──────────────────────────────────────────────────────────────
+	# ── wasmtime ──────────────────────────────────────────────────────────────
-  # Fix requires wasmtime 42.0.2+ → cranelift-assembler-x64 0.129+ → rustc 1.91.0+
+	# Fix requires wasmtime 42.0.2+ → cranelift-assembler-x64 0.129+ → rustc 1.91.0+
-  # Toolchain pinned to 1.88.0. Unblock when toolchain upgrades.
+	# Toolchain pinned to 1.88.0. Unblock when toolchain upgrades.
-  # We do NOT use Winch backend, Component Model, or 64-bit tables;
+	# We do NOT use Winch backend, Component Model, or 64-bit tables;
-  # most CVEs below only affect those code paths.
+	# most CVEs below only affect those code paths.
-  "RUSTSEC-2026-0006", # wasmtime: segfault with f64.copysign on x86-64
+	"RUSTSEC-2026-0006", # wasmtime: segfault with f64.copysign on x86-64
-  "RUSTSEC-2026-0020", # wasmtime: WASI guest-controlled resource exhaustion
+	"RUSTSEC-2026-0020", # wasmtime: WASI guest-controlled resource exhaustion
-  "RUSTSEC-2026-0021", # wasmtime: panic in wasi:http/types.fields
+	"RUSTSEC-2026-0021", # wasmtime: panic in wasi:http/types.fields
-  "RUSTSEC-2026-0085", # wasmtime: panic lifting flags component value
+	"RUSTSEC-2026-0085", # wasmtime: panic lifting flags component value
-  "RUSTSEC-2026-0086", # wasmtime: host data leakage 64-bit tables + Winch
+	"RUSTSEC-2026-0086", # wasmtime: host data leakage 64-bit tables + Winch
-  "RUSTSEC-2026-0087", # wasmtime: segfault f64x2.splat on Cranelift x86-64
+	"RUSTSEC-2026-0087", # wasmtime: segfault f64x2.splat on Cranelift x86-64
-  "RUSTSEC-2026-0088", # wasmtime: data leakage pooling allocator instances
+	"RUSTSEC-2026-0088", # wasmtime: data leakage pooling allocator instances
-  "RUSTSEC-2026-0089", # wasmtime: host panic table.fill with Winch
+	"RUSTSEC-2026-0089", # wasmtime: host panic table.fill with Winch
-  "RUSTSEC-2026-0091", # wasmtime: OOB write transcoding component model strings
+	"RUSTSEC-2026-0091", # wasmtime: OOB write transcoding component model strings
-  "RUSTSEC-2026-0092", # wasmtime: panic transcoding misaligned UTF-16 strings
+	"RUSTSEC-2026-0092", # wasmtime: panic transcoding misaligned UTF-16 strings
-  "RUSTSEC-2026-0093", # wasmtime: heap OOB read UTF-16 to latin1+utf16
+	"RUSTSEC-2026-0093", # wasmtime: heap OOB read UTF-16 to latin1+utf16
-  "RUSTSEC-2026-0094", # wasmtime: masked return value table.grow Winch
+	"RUSTSEC-2026-0094", # wasmtime: masked return value table.grow Winch
-  "RUSTSEC-2026-0095", # wasmtime: Winch sandbox-escaping memory access
+	"RUSTSEC-2026-0095", # wasmtime: Winch sandbox-escaping memory access
-  "RUSTSEC-2026-0096", # wasmtime: miscompiled guest heap aarch64 Cranelift
+	"RUSTSEC-2026-0096", # wasmtime: miscompiled guest heap aarch64 Cranelift
 
-  # ── rand 0.9.2 ────────────────────────────────────────────────────────────
+	# ── rand 0.9.2 ────────────────────────────────────────────────────────────
-  # Unsound only when a custom Rust logger calls rand::rng() during init.
+	# Unsound only when a custom Rust logger calls rand::rng() during init.
-  # No custom logger in our stack. No fixed version available yet.
+	# No custom logger in our stack. No fixed version available yet.
-  "RUSTSEC-2026-0097", # rand: unsound with custom logger using rand::rng()
+	"RUSTSEC-2026-0097", # rand: unsound with custom logger using rand::rng()
 
-  # ── webpki ────────────────────────────────────────────────────────────────
+	# ── webpki ────────────────────────────────────────────────────────────────
-  # Name-constraints validation bugs in transitive webpki dep.
+	# Name-constraints validation bugs in transitive webpki dep.
-  # We do not rely on certificate name constraints in our P2P/RPC stack.
+	# We do not rely on certificate name constraints in our P2P/RPC stack.
-  "RUSTSEC-2026-0098", # webpki: URI name constraints incorrectly accepted
+	"RUSTSEC-2026-0098", # webpki: URI name constraints incorrectly accepted
-  "RUSTSEC-2026-0099", # webpki: wildcard name constraints incorrectly accepted
+	"RUSTSEC-2026-0099", # webpki: wildcard name constraints incorrectly accepted
 ]
 
 # License compliance
@@ -58,31 +58,31 @@ ignore = [
 [licenses]
 confidence-threshold = 0.8
 allow = [
-  "Apache-2.0 WITH LLVM-exception",
+	"Apache-2.0 WITH LLVM-exception",
-  "Apache-2.0",
+	"Apache-2.0",
-  "BSD-2-Clause",
+	"BSD-2-Clause",
-  "BSD-3-Clause",
+	"BSD-3-Clause",
-  "BSL-1.0",
+	"BSL-1.0",
-  "CC0-1.0",
+	"CC0-1.0",
-  "CDLA-Permissive-2.0",
+	"CDLA-Permissive-2.0",
-  "GPL-3.0-only WITH Classpath-exception-2.0",
+	"GPL-3.0-only WITH Classpath-exception-2.0",
-  "GPL-3.0-only",
+	"GPL-3.0-only",
-  "GPL-3.0-or-later WITH Classpath-exception-2.0",
+	"GPL-3.0-or-later WITH Classpath-exception-2.0",
-  "GPL-3.0-or-later",
+	"GPL-3.0-or-later",
-  "ISC",
+	"ISC",
-  "MIT",
+	"MIT",
-  "MIT-0",
+	"MIT-0",
-  "MPL-2.0",
+	"MPL-2.0",
-  "NCSA",
+	"NCSA",
-  "OpenSSL",
+	"OpenSSL",
-  "Unicode-3.0",
+	"Unicode-3.0",
-  "Unicode-DFS-2016",
+	"Unicode-DFS-2016",
-  "Unlicense",
+	"Unlicense",
-  "Zlib",
+	"Zlib",
 ]
 exceptions = [
-  # ring uses a custom ISC-style license
+	# ring uses a custom ISC-style license
-  { allow = ["OpenSSL"], name = "ring" },
+	{ allow = ["OpenSSL"], name = "ring" },
 ]
 
 [licenses.private]
@@ -103,6 +103,6 @@ unknown-registry = "warn"
 unknown-git = "warn"
 allow-registry = ["https://github.com/rust-lang/crates.io-index"]
 allow-git = [
-  # Our serde fork with wasm32v1-none target fix (pending upstream merge)
+	# Our serde fork with wasm32v1-none target fix (pending upstream merge)
-  "https://github.com/pezkuwichain/serde.git",
+	"https://github.com/pezkuwichain/serde.git",
 ]