ci: make the suppression guard log every check, not just failures

The guard emitted nothing when it passed, so its success was indistinguishable
in the CI log from the step never running at all — the same silent-skip failure
mode it exists to catch, one level up. Confirmed on run 332: the job was green
and the log carried no trace of the step either way.

Each crate/target check and the canary now echo their result, followed by a
count and the exit code, so a reader can see the guard ran and what it proved.

Verified by extracting the run: block from the workflow and executing it
verbatim under bash -e: 4 checks, canary found, exit 0.

.forgejo/workflows/check-rust.yml

@@ -86,12 +86,18 @@ jobs:
       #
       # CRATES must mirror the crates named in .cargo/audit.toml. Adding an
       # entry there without adding its crate here leaves it unguarded.
+      #
+      # Every check echoes its result, including the passing ones. A guard that
+      # is silent on success cannot be told apart in the log from a guard that
+      # never ran — which is the same silent-skip failure mode this step exists
+      # to catch, one level up.
       - name: Verify suppressed advisories are still unreachable
         run: |
           set -u
           CRATES="quick-xml rsa"
           TARGETS="x86_64-unknown-linux-gnu x86_64-pc-windows-msvc"
           rc=0
+          checks=0
           for crate in $CRATES; do
             for target in $TARGETS; do
               # An absent crate exits 0 with empty stdout ("nothing to print"
@@ -104,9 +110,12 @@ jobs:
                 continue
               }
               if [ -n "$out" ]; then
-                echo "$crate is now compiled for $target — its .cargo/audit.toml suppression is no longer justified (see #310)."
+                echo "FAIL: $crate is now compiled for $target — its .cargo/audit.toml suppression is no longer justified (see #310)."
                 rc=1
+              else
+                echo "ok: $crate absent from $target"
               fi
+              checks=$((checks + 1))
             done
           done
           # Canary: a crate known to be present. If this stops being found, the
@@ -114,9 +123,12 @@ jobs:
           canary=$(cargo tree --manifest-path src-tauri/Cargo.toml --locked \
                      -i tar --target x86_64-unknown-linux-gnu 2>/dev/null) || true
           if [ -z "$canary" ]; then
-            echo "Canary failed: 'tar' was not found although it is a known dependency. The guard is not proving anything."
+            echo "FAIL: canary 'tar' was not found although it is a known dependency. The guard is not proving anything."
             rc=1
+          else
+            echo "ok: canary 'tar' found for x86_64-unknown-linux-gnu"
           fi
+          echo "Suppression guard: $checks checks, exit $rc"
           exit $rc
 
       - name: cargo test