chore(security): SHA-pin dtolnay/rust-toolchain + add top-level workflow permissions (#74)

## Summary

Salvages an unpushed orphan commit (\`bbce567\` from 2026-05-23) from
local main during a 2026-05-31 closeout sweep:

- SHA-pins \`dtolnay/rust-toolchain@stable\` →
\`@4be9e76fd7c4901c61fb841f559994984270fce7 # stable\` in
\`.github/workflows/security.yml\`.
- Adds top-level \`permissions: read-all\` to
\`.github/workflows/ocaml-core.yml\` (was missing; baseline-deny pattern
from the fleet-wide hardening pass).
- Net diff: 2 files, +4/-2.

## Verification

- SHA \`4be9e76f...\` confirmed real via \`gh api
repos/dtolnay/rust-toolchain/commits/4be9e76fd7c4901c61fb841f559994984270fce7\`
→ HTTP 200.
- Original commit GPG-signed.

## Test plan
- [x] SHA verified live
- [ ] CI passes (running)

Author: hyperpolymath

.github/workflows/ocaml-core.yml

@@ -19,6 +19,8 @@ on:
       - 'dune-project'
       - '*.opam'
 
+permissions: read-all
+
 jobs:
   build:
     name: Build and Test OCaml Core

.github/workflows/security.yml

@@ -26,7 +26,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
 
       - name: Install cargo-audit
         run: cargo install cargo-audit --locked
@@ -60,7 +60,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
 
       - name: Cache cargo registry
         uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4