chore(ci): harden CI workflow

Pin all actions to verified commit SHAs, check out without persisted
credentials, and pin the Rust toolchain to 1.98.1. Add a concurrency
group, per-job timeouts, and a cache to the test job, and run on
ubuntu-26.04 instead of ubuntu-latest.