Roll Rust dependencies and pin workflow actions

[yvette-carlisle]

Summary

• Roll compatible Rust workspace dependencies and regenerate Cargo.lock
• Pin active GitHub Actions external refs to full commit SHAs
• Clear Dependabot labels with explicit labels: [] for cargo and github-actions
• Leave incompatible majors and qdrant-client service-coupled bump as follow-up signals

Validation

• cargo make --no-workspace upgrade-dependencies
• cargo make fmt
• cargo make checks
• git diff --check
• active workflow uses refs full-SHA scan
• ruby YAML parse/readback for .github/dependabot.yml

Notes

• actionlint still reports pre-existing workflow issues on untouched main: merge_group paths-ignore and shellcheck warnings; left out of this dependency lane.