Refresh dependencies and normalize workflow pins

[yvette-carlisle]

Summary

• refresh Cargo.lock to the latest Rust 1.95.0-compatible dependency graph
• pin GitHub Actions refs to full commit SHAs with release-tag provenance, including upload-artifact v7.0.1 and download-artifact v8.0.1
• remove checked-in .github/rulesets files

Verification

• actionlint .github/workflows/language.yml .github/workflows/pages.yml .github/workflows/release.yml
• swift package --package-path native/macos-host resolve
• cargo make checks
• scripts/perf/self-check-macos.sh
• cargo update --dry-run --verbose leaves only target-lexicon v0.13.3 held by cfg-expr exact transitive requirement

Dependency Notes

• Sparkle and SwiftLintPlugins remain on their current exact versions because upstream latest releases are still 2.9.1 and 0.63.2.
• cargo update --dry-run reports no remaining Rust 1.95-compatible lockfile updates after this refresh.