deny: workaround cargo-deny 0.18.x GPL-3.0-or-later parse bug

cargo-deny 0.18.3 (the latest that installs on rust 1.85) can't parse
the SPDX 'GPL-3.0-or-later' suffix — 'expected a <bare-gnu-license>'.
CI uses cargo-deny-action@v1 (bundles 0.19+) which parses it correctly.

Switching to bare 'GPL-3.0' lets local 'cargo deny check' work on the
pinned toolchain. ADR-0004's GPL-3.0-or-later stance is unchanged; this
is a parser workaround flagged for revert when the MSRV lifts past 1.88
(where cargo-deny 0.19.x installs natively).

Three of four 'cargo deny check' subcommands now pass locally:
  - licenses ok
  - bans ok
  - sources ok
  - advisories: fails locally only because the advisory-db contains CVSS 4.0
    entries (anchor-lang RUSTSEC-2026-0146) that cargo-deny 0.18.3's parser
    rejects. Unfixable on the rust 1.85 toolchain; CI's 0.19+ parses fine.

Surfaced by Task 7's done-checklist run; not a Task 7 code change.

deny.toml

@@ -49,7 +49,14 @@ ignore = [
 # `cargo deny check licenses` (spec §6.1) — this list passes the full
 # str0m/opus/axum transitive graph clean.
 allow = [
-    "GPL-3.0-or-later",
+    # SPDX expression "GPL-3.0-or-later" is valid SPDX but cargo-deny 0.18.x
+    # (the latest that installs on rust 1.85) can't parse the `-or-later`
+    # suffix. CI uses `cargo-deny-action@v1` (newer) which parses it; we use
+    # the bare `"GPL-3.0"` form so local `cargo deny check` works on the
+    # pinned toolchain. ADR-0004's "GPL-3.0-or-later" stance is unchanged;
+    # this is a parser workaround. When the workspace MSRV lifts past 1.88
+    # (where cargo-deny 0.19.x installs), revert this to `"GPL-3.0-or-later"`.
+    "GPL-3.0",
     "MIT",
     "Apache-2.0",
     "BSD-3-Clause",