ci: harden workflow best practices

[ubugeeei]

Summary

• Use locked Cargo operations throughout CI and local scripts.
• Cancel stale PR runs while preserving main/release runs.
• Add job timeouts, explicit shell defaults, and Cargo color.
• Harden release publishing with tag-on-main verification, lockfile verification, core tests, package listing, and publish dry-run before publish.
• Add Dependabot coverage for GitHub Actions and Cargo updates.
• Add crate description metadata and local package:core validation.

Local validation before push

• pnpm ci:local
• pnpm package:core
• git diff --check
• cargo fmt --all -- --check
• cargo metadata --locked --format-version 1 >/dev/null
• YAML parse for .github/workflows/ci.yml, .github/workflows/release_core.yml, and .github/dependabot.yml

Closes #22