ci: harden build and release workflows

[crenshawdev]

Summary

• add push and pull-request CI for rustfmt, Clippy, and the locked test suite
• upgrade official GitHub Actions to their current Node 24 majors and pin every external action to an immutable commit
• pin the privileged Flatpak builder container to its OCI digest and the verified Flatpak action v6.7 commit
• verify the downloaded nFPM archive against its published SHA-256 before privileged extraction
• refuse release tags whose commits are not reachable from main
• add grouped weekly Cargo and GitHub Actions Dependabot updates
• add the CI status badge

Validation

• actionlint .github/workflows/*.yml
• cargo fmt --all -- --check
• cargo clippy --locked --all-targets -- -D warnings
• cargo test --locked (15 passed)