CI: restore native safety checks and harden workflows

[BeaCox]

Summary

• rewrite the product CI into an explicit locked quality gate plus native platform matrix while preserving the required status-check names
• restore the isolated Linux Secret Service and Windows Credential Manager backup/restore round trips that the current workflow no longer executed
• pin every external action used by CI and release workflows to an immutable commit and add monthly Dependabot updates for GitHub Actions
• limit Rust cache writes to trusted pushes to main, keep merge queue and reusable release coverage, and retain native x64/ARM64 launch smoke tests

Audit notes

The design was checked against the current Tauri GitHub pipeline guidance, GitHub Actions security/caching guidance, and CI patterns in Tauri Action, GitButler, and Clash Verge Rev. CleanerX intentionally keeps full checks on every PR: its recent product CI completes in about four minutes, and path filtering is not a good tradeoff for mutation and backup safety.

The branch protection contexts remain unchanged:

• Quality and Linux smoke test
• macOS tests
• Windows tests

Validation

• make check
• actionlint v1.7.12 (with the live windows-11-vs2026-arm preview runner label explicitly allowed because actionlint's bundled label list lags GitHub)
• YAML parsing for both workflows and Dependabot configuration
• git diff --check