chore: clean up CI/CD workflows

Remove unnecessary/redundant workflows:
- rust.yml (duplicate of rust-ci.yml, dead branch trigger)
- jekyll-gh-pages.yml (not a Jekyll site, has .nojekyll)
- ethicalcheck.yml (pointed to demo URL, not this project)
- greetings.yml (template bloat, placeholder messages)
- label.yml (unnecessary for solo project)
- stale.yml (unnecessary for solo project)
- npm-bun-blocker.yml (redundant with language-policy.yml)
- ts-blocker.yml (redundant with language-policy.yml)

Fix remaining workflows:
- codeql.yml: change language from javascript-typescript to actions
  (Rust not supported by CodeQL)
- rust-ci.yml: SHA-pin all actions, add permissions: read-all

Reduces workflow count from 22 to 14.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: Jonathan D.A. Jewell

.github/workflows/codeql.yml

@@ -21,7 +21,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - language: javascript-typescript
+          - language: actions
             build-mode: none
 
     steps:

.github/workflows/ethicalcheck.yml

@@ -1,6 +1,9 @@
 # SPDX-License-Identifier: PMPL-1.0
 name: Rust CI
 on: [push, pull_request]
+
+permissions: read-all
+
 env:
   CARGO_TERM_COLOR: always
   RUSTFLAGS: -Dwarnings
@@ -9,29 +12,29 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.1
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b # stable
         with:
           components: rustfmt, clippy
-      - uses: Swatinem/rust-cache@v2
-      
+      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
+
       - name: Check formatting
         run: cargo fmt --all -- --check
-      
+
       - name: Clippy lints
         run: cargo clippy --all-targets --all-features -- -D warnings
-      
+
       - name: Run tests
         run: cargo test --all-features
-      
+
       - name: Build release
         run: cargo build --release
 
   security:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.1
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b # stable
       - name: Install cargo-audit
         run: cargo install cargo-audit
       - name: Security audit
@@ -42,12 +45,12 @@ jobs:
   coverage:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.1
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b # stable
       - name: Install tarpaulin
         run: cargo install cargo-tarpaulin
       - name: Generate coverage
         run: cargo tarpaulin --out Xml
-      - uses: codecov/codecov-action@v5
+      - uses: codecov/codecov-action@ad3126e916f78f00edff4ed0317cf185271ccc2d # v5.4.2
         with:
           files: cobertura.xml