Pin every CI action to a commit SHA, and stop handing the workflow a write token

[stormer78]

Why this repository in particular

The plugin is installed by cloning main
(claude plugin marketplace add OpenVTC/vta-agent-memory), and hooks/hooks.json
runs the plugin binary at every SessionStart. So whatever can write to main
can run code on every installing machine. Two things made that reachable from
CI: every third-party action was a mutable ref, and the workflow declared no
permissions: block at all, so it inherited the repository default token.

What changed in .github/workflows/ci.yml

• Every uses: is pinned to a full 40-character commit SHA, with the release
  it corresponds to in a trailing comment:
  • actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
  • Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
    (the commit the annotated v2.9.2 tag points at, not the tag object)
• dtolnay/rust-toolchain@stable is gone. That was a branch ref, and
  pinning the action by SHA would have silently changed which toolchain it
  installs, because it derives that from the ref name. Hosted runners ship
  rustup, so Install Rust is now a run: step installing an explicit
  version. The version lives in one place (RUST_TOOLCHAIN), and the step fails
  if Cargo.toml's rust-version disagrees with it — so the toolchain the
  README promises is the one CI actually builds with.
• permissions: contents: read at the top level, and
  persist-credentials: false on all three checkouts so the token is not left
  behind in .git/config. Nothing in this workflow pushes, comments or
  publishes.
• The cache is only written from main (save-if), so a pull request can
  read it but cannot seed what later runs restore.
• A new workflow hygiene job fails on any uses: that is not a 40-hex SHA
  (local ./… actions exempt; a docker:// image must be pinned by digest), and
  on any workflow file without a top-level permissions: block. A mutable ref
  added six months from now cannot slip back in unnoticed.

New .github/dependabot.yml

github-actions and cargo, weekly. Dependabot rewrites a SHA pin and its
version comment together, so pinning is not freezing.

cooldown: default-days: 7 holds a new release back for a week before it is
proposed: a hijacked or re-tagged release is usually noticed and pulled within
days, and waiting keeps it from arriving here as a routine bump on day one.
Security updates are not delayed by it. Cargo patch releases are grouped; minor
bumps stay separate, because for the 0.x vta-sdk family a minor bump is a
breaking one and deserves its own review.

Still needs a repository admin

Neither of these can be done from a workflow file, and both are what make the
pinning above matter:

• Set the default workflow permissions to read-only
  (default_workflow_permissions=read, can_approve_pull_request_reviews=false).
  It is currently write.
• Protect main (require a pull request and passing CI). It is currently
  unprotected, so a write-scoped token could push to it directly.

Checks

The guard was run locally over .github/: all four uses: refs pass, and an
unpinned @v4 / @main line fails as intended. Both changed YAML files parse
with python3 -c "yaml.safe_load(...)". No Rust source changed on this branch.