ci: add a cargo-machete gate for unused dependencies

.github/workflows/rs_ci.yml

@@ -228,3 +228,20 @@ jobs:
         with:
           cache: false
       - run: ./scripts/verify_tls_root_features.sh
+
+  # Unused dependencies. Static (no build), so it is deterministic. A crate
+  # used only through a string path or kept as a version bound goes in
+  # `[package.metadata.cargo-machete] ignored` in bottlecap/Cargo.toml. The
+  # binary is called directly: it needs no cargo and no toolchain.
+  cargo-machete:
+    name: Unused Dependencies
+    runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: taiki-e/install-action@1168f6810a3cb30a3514bf5756a3b7f0422c6df8 # v2.87.28
+        with:
+          tool: cargo-machete@0.9.2
+      - working-directory: bottlecap
+        run: cargo-machete