ci: harden and simplify workspace checks

[Takaros999]

This PR follows up on Paolo's review comments from PRs #1 and #2.

• centralizes Rust and Clippy lint policy at the workspace level
• keeps rust-toolchain.toml as the single project toolchain version
• pins every GitHub Action to an immutable commit SHA
• combines formatting and linting, removes the redundant debug build, and simplifies cargo-deny configuration
• trims host-specific tooling from the README while retaining concise development and Nitro setup instructions

Reviewable LOC: 127 changed lines.
Runtime behavior: unchanged.

Verification:

• cargo fmt --all -- --check
• cargo clippy --locked --all-targets --all-features --
• cargo test --locked --all
• cargo build --locked --release
• cargo deny check