Deny-all with explicit allows (Cargo files, src/, init/, kernel/config). Previously the full linux submodule was shipped into every build context.
