refactor(ci): migrate to shared workflows

[mablr]

Summary

• migrate standard Rust lint checks to the shared, immutable-SHA-pinned rust-lint workflow
• replace the local actionlint job with the shared GitHub Actions scanner while preserving wallet-specific policy checks
• clear RustSec advisories by removing a stale exception and upgrading ruint to 1.20.0

Details

The shared Rust workflow now runs nightly clippy and formatting alongside typos and cargo-deny. The repository-owned Tempo lint job and aggregate lint success check remain in place.

Workflow validation now uses the shared scanner with actionlint and pinact enabled. Wallet-specific fork-safety, changelog, PR-audit, and pull_request_target policy checks remain local.

Closes OSS-543.

[decofe]

Findings

Blocking

1. The changelog generator still uses pull_request_target, checks out the PR head, and invokes Claude with ANTHROPIC_API_KEY. This is a secret-bearing path over PR-controlled content; please migrate it to the pull_request + label pattern used by wallet-cli, with manual changelog entry handling for forks.

2. The new shared workflow pins have no version comments, so enabling pinact makes Workflow Validation fail at lint.yml:21 and workflow-validation.yml:25. Add verifiable version comments and update the stale dtolnay/rust-toolchain pins reported by the scan.

3. workflow-validation.yml explicitly requires pull_request_target, which conflicts with the security direction of this migration. Remove that invariant after replacing the generator.

Supply-chain review

• No direct dependency changes were found. The lockfile moves ruint 1.18.0 to 1.20.0 and removes RUSTSEC-2026-0220; the added ark-* 0.6.0 crates are mature, non-yanked, and had no OSV findings.
• zizmor found the dangerous trigger above plus the existing template-injection warnings in build.yml; pinact also reports malformed/missing version comments across existing action pins.
• cargo-deny could not complete in the review sandbox because both PR and main require an unauthenticated fetch of the existing pinned tempoxyz/mpp-rs Git dependency; this was not introduced by this PR.

[grandizzy]

please check Gh action scan CI failure, thanks!

[figtracer]

lgtm