ci: bump dtolnay/rust-toolchain from fa04a1451ff1842e2626ccb99004d0195b455a88 to 2c7215f132e9ebf062739d9130488b56d53c060c #467

	# SPDX-License-Identifier: MPL-2.0
	# Prevention workflow - validates all workflows have proper security config
	name: Workflow Security Linter
	on:
	pull_request:
	paths:
	- '.github/workflows/**'
	push:
	paths:
	- '.github/workflows/**'
	permissions: read-all
	# Actions concurrency pool. Applied only to read-only check workflows
	# (no publish/mutation), so cancelling a superseded run is always safe.
	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true
	jobs:
	lint-workflows:
	runs-on: ubuntu-latest
	timeout-minutes: 10
	steps:
	- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	- name: Check SPDX headers
	run: \|
	errors=0
	for f in .github/workflows/.yml .github/workflows/.yaml; do
	[ -f "$f" ] \|\| continue
	if ! head -1 "$f" \| grep -q "SPDX-License-Identifier"; then
	echo "ERROR: $f missing SPDX header"
	errors=$((errors + 1))
	fi
	done
	exit $errors
	- name: Check permissions declaration
	run: \|
	errors=0
	for f in .github/workflows/.yml .github/workflows/.yaml; do
	[ -f "$f" ] \|\| continue
	if ! grep -q "^permissions:" "$f"; then
	echo "ERROR: $f missing permissions declaration"
	errors=$((errors + 1))
	fi
	done
	exit $errors
	- name: Check pinned actions
	run: \|
	errors=0
	for f in .github/workflows/.yml .github/workflows/.yaml; do
	[ -f "$f" ] \|\| continue
	# Look for uses: without SHA
	if grep -E "uses:.*@v[0-9]" "$f" \| grep -v "#"; then
	echo "WARNING: $f has unpinned actions (missing SHA comment)"
	fi
	done

Provide feedback