ci: SHA-pin actions in rust.yml + proof-regression.yml

Folds the approved CI action-pinning into PR #24 (G2/G3 governance).

- proof-regression.yml: pin actions/cache@v4 -> @6849a648 (SHA already
  trusted in rust.yml). Unblocks the Lean proof job so JtvEcho.lean is
  actually built/verified by CI.
- rust.yml: replace unpinned, mis-named dtolnay/rust-action@stable with
  the trusted dtolnay/rust-toolchain@4be9e76 # stable (×4), and add a
  permissions: contents: read block. Clears the Hypatia unpinned_action
  + missing_permissions findings for rust.yml.

Note: rust.yml's *build* jobs will still fail — it targets a different
project's layout (packages/jtzig, tools/cli, which don't exist here) and
the crate depends on the unvendored sibling patacl-core. That is Phase-3
build-truth work; rust-ci.yml is the correctly-configured Rust workflow.

https://claude.ai/code/session_01EJLZKDtcF1RGdKx6TcUTQG

Author: claude

.github/workflows/proof-regression.yml

@@ -48,7 +48,7 @@ jobs:
           echo "$HOME/.elan/bin" >> "$GITHUB_PATH"
 
       - name: Cache Lean build
-        uses: actions/cache@v4
+        uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4
         with:
           path: |
             jtv_proofs/.lake

.github/workflows/rust.yml

@@ -7,6 +7,9 @@ on:
   pull_request:
     branches: ["main"]
 
+permissions:
+  contents: read
+
 env:
   CARGO_TERM_COLOR: always
   RUSTFLAGS: -Dwarnings
@@ -19,7 +22,7 @@ jobs:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-action@stable
+        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
 
       - name: Cache cargo registry
         uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4
@@ -49,7 +52,7 @@ jobs:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-action@stable
+        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
 
       - name: Cache cargo registry
         uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4
@@ -81,7 +84,7 @@ jobs:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-action@stable
+        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
         with:
           components: clippy
 
@@ -112,7 +115,7 @@ jobs:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-action@stable
+        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
         with:
           components: rustfmt