Pin workflow actions to commit SHAs and configure Dependabot

[Commanderx-code]

Change

Pins every GitHub Action to a commit SHA. Tags like actions/checkout@v4 can be moved. If one of these actions were compromised, the moved tag would run the attacker's code in the job that builds and uploads release packages. All 17 uses: lines now pin the exact commit that each tag points to today, so CI runs the same code as before:

Action	Pinned to
actions/checkout	11d5960 (v4.4.0)
actions/setup-node	49933ea (v4.4.0)
actions/upload-artifact	ea165f8 (v4.6.2)
actions/download-artifact	d3f86a1 (v4.3.0)
dtolnay/rust-toolchain	6bed076 (head of its stable branch)

rust-toolchain picks its Rust version from the branch you reference. Its steps now pass toolchain: stable explicitly, so a later pin update can't change the Rust version.

Adds .github/dependabot.yml. Dependabot will open grouped weekly update PRs every Monday:

• GitHub Actions: it moves the pinned SHAs and their version comments.
• npm and Cargo: minor and patch updates are grouped into one PR per ecosystem; major updates arrive separately.
• linutil_core is excluded. Its revision must match REVISION in src-tauri/src/toolbox.rs, and scripts/pin-toolbox.mjs updates the two together.

Security updates were already enabled in the repository settings and are unchanged.

Updates docs/development.md to describe how actions are pinned and how Dependabot is configured.

Validation

• Each pin was resolved through the GitHub API. Each v4 tag currently points at the pinned commit, so behaviour is unchanged.
• Before pinning rust-toolchain, I checked that its action.yml at 6bed076 defaults to stable.
• Both workflow files and dependabot.yml parse as YAML. No unpinned uses: remain.
• npm run check: passed.
• This PR's own CI run uses the pinned actions in every job, including the build, the install tests and the audits.

Review notes

• Expect Dependabot PRs every Monday, one group per ecosystem. They must pass the 9 required checks and the CodeQL rule before they can merge.
• For an Action update, check the linked release notes before merging. Its SHA pins a different version of code that runs in CI.

🤖 Generated with Claude Code