ci: audit and harden GitHub Actions workflows

- Bump all actions to latest versions (checkout@v6, upload-artifact@v7,
  download-artifact@v8, labeler@v6, gh-release@v3, gpg-import@v7)
- Replace fragile curl|bash tool install with taiki-e/install-action@v2
- Fix Swatinem/rust-cache ordering: must run AFTER toolchain install
  for correct cache key derivation
- Add --all-targets to clippy (CI now matches local testing)
- Add RUSTDOCFLAGS=-D warnings to doc step (fail on broken links)
- Fix ARM64 build order: install Rust toolchain before adding target
  and configuring linker
- Add rust-toolchain.toml pinning Rust 1.94.0 for deterministic builds
- Update Cargo.lock: rustls-webpki v0.103.11->v0.103.13 (fixes 3 CVEs)
- Fix softprops/action-gh-release@v3: include checksums in files list
  (v3 removed the checksum input parameter)
- Fix clippy manual_checked_ops lint in screenshot.rs
- Clean up trailing whitespace and missing newlines in YAML files

src/screenshot.rs

@@ -171,9 +171,9 @@ impl Screenshot {
                 }
 
                 if count > 0 {
-                    let r = (r / count) as u8;
-                    let g = (g / count) as u8;
-                    let b = (b / count) as u8;
+                    let r = r.checked_div(count).unwrap_or(0) as u8;
+                    let g = g.checked_div(count).unwrap_or(0) as u8;
+                    let b = b.checked_div(count).unwrap_or(0) as u8;
 
                     // Fill the block
                     for py in 0..pixel_size {