ci: audit and harden GitHub Actions workflows

- Bump all actions to latest versions (checkout@v6, upload-artifact@v7,
  download-artifact@v8, labeler@v6, gh-release@v3, gpg-import@v7)
- Replace fragile curl|bash tool install with taiki-e/install-action@v2
- Fix Swatinem/rust-cache ordering: must run AFTER toolchain install
  for correct cache key derivation
- Add --all-targets to clippy (CI now matches local testing)
- Add RUSTDOCFLAGS=-D warnings to doc step (fail on broken links)
- Fix ARM64 build order: install Rust toolchain before adding target
  and configuring linker
- Add rust-toolchain.toml pinning Rust 1.94.0 for deterministic builds
- Update Cargo.lock: rustls-webpki v0.103.11->v0.103.13 (fixes 3 CVEs)
- Fix softprops/action-gh-release@v3: include checksums in files list
  (v3 removed the checksum input parameter)
- Fix clippy manual_checked_ops lint in screenshot.rs
- Clean up trailing whitespace and missing newlines in YAML files

.github/workflows/security.yml

@@ -19,42 +19,33 @@ jobs:
   security-audit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: Swatinem/rust-cache@v2
-      
+      - uses: actions/checkout@v6
+
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
-      
+
+      - uses: Swatinem/rust-cache@v2
+
       - name: Install security tools
-        run: |
-          curl -L --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash
-          cargo binstall --no-confirm cargo-audit cargo-deny cargo-cyclonedx cargo-outdated || \
-          cargo install cargo-audit cargo-deny cargo-cyclonedx cargo-outdated
-      
+        uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-audit,cargo-deny,cargo-cyclonedx,cargo-outdated
+
       - name: Run cargo audit
         run: cargo audit
-      
+
       - name: Run cargo deny
         run: cargo deny check
-      
+
       - name: Generate Software Bill of Materials (SBOM)
         run: cargo cyclonedx --format json --override-filename bom
-      
+
       - name: Upload SBOM
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: sbom
           path: bom.json
-      
+
       - name: Check for outdated dependencies
         run: cargo outdated --exit-code 1 || echo "Some dependencies are outdated"
-      
-      - name: Security summary
-        run: |
-          echo "=== Security Scan Complete ==="
-          echo "✅ cargo audit - Vulnerability scanning"
-          echo "✅ cargo deny - Advisory and license checking"
-          echo "✅ SBOM generated - Software Bill of Materials"
-          echo "✅ Outdated dependencies checked"
-          echo ""
-          echo "Next scheduled scan: Weekly (Sunday 00:00 UTC)"
+