ci: least-privilege token, SHA-pinned actions, cargo audit job

- ci.yml declares permissions: contents: read instead of the default
  token scope.
- Every action is pinned to the commit its current tag points at
  (checkout v4.4.0, upload-artifact v4.6.2, action-gh-release v2.6.2),
  so a moved tag can't change what runs with release write access.
- A cargo audit job runs on every push; the single ignored advisory
  (RUSTSEC-2023-0071, rsa via russh, no fix available) is recorded with
  its rationale in rust/.cargo/audit.toml (SEC-20261012-019, -012).

Release signing and macOS notarisation are not part of this change.

rust/.cargo/audit.toml

@@ -0,0 +1,9 @@
+# cargo audit configuration (CI runs `cargo audit` from rust/).
+[advisories]
+ignore = [
+    # 2026-10-12: rsa Marvin timing side channel, pulled in by russh's `rsa` feature. No fixed
+    # release exists. The client signs once per user-initiated connection, so collecting enough
+    # timings is impractical; Ed25519 is the default for generated keys. Re-check when rsa ships a
+    # constant-time release (SEC-20261012-012).
+    "RUSTSEC-2023-0071",
+]