ci: least-privilege release publishing, no persisted tokens, pinned audit, checksums

- Release Builds: the build/test matrix ran ~1,400 third-party build
  scripts and tests with a contents:write token persisted in .git/config.
  It now runs with contents:read and persist-credentials: false; a
  separate publish job (no project or dependency code) downloads the
  artefacts, writes SHA256SUMS and attaches both to the release. The
  release now waits for every platform instead of publishing partially.
- CI/Fuzz checkouts don't persist credentials; cargo-audit is pinned
  (0.22.2), fails on yanked crates, and also audits fuzz/Cargo.lock;
  fuzz runs set -timeout=10 so slow-input bugs (like the IRC OSC one)
  are reported instead of hiding under libFuzzer's 20-minute default.
- updates/index.php: array-valued query parameters no longer raise
  TypeErrors/warnings; nosniff header.

updates/index.php

@@ -1,6 +1,8 @@
 <?php
-$platform = isset($_GET['platform']) ? $_GET['platform'] : '';
-$arch = isset($_GET['arch']) ? $_GET['arch'] : '';
+// Query parameters may arrive as arrays (?arch[]=x); treat anything but a string as absent.
+$param = function ($name) { return isset($_GET[$name]) && is_string($_GET[$name]) ? $_GET[$name] : ''; };
+$platform = $param('platform');
+$arch = $param('arch');
 $platform = preg_replace('/[^a-z0-9_-]/i', '', $platform);
 $arch = preg_replace('/[^a-z0-9_-]/i', '', $arch);
 
@@ -13,7 +15,8 @@ if ($platform && $arch) {
 }
 
 $accept = isset($_SERVER['HTTP_ACCEPT']) ? $_SERVER['HTTP_ACCEPT'] : '';
-$format = isset($_GET['format']) ? strtolower($_GET['format']) : '';
+$format = strtolower($param('format'));
+header('X-Content-Type-Options: nosniff');
 
 $wantsJson = $format === 'json' || strpos($accept, 'application/json') !== false;
 $wantsVersion = $format === 'version';