fix(ci): remediate code-scanning alerts #778-#790

[dekobon]

Remediates the open code-scanning alerts in the #778–#790 range.

CodeQL cache-poisoning #785–#790 (release.yml)

All six traced to the workflow_dispatch tag input flowing through
preflight's ref output into every downstream checkout, followed by
cargo/cross executing that checkout. The input was never needed:
a rehearsal now dispatches from the tag
(gh workflow run release.yml --ref v0.0.0-test1), so github.ref is
the tag for both triggers and nothing user-typed reaches a checkout.
Preflight refuses a non-tag ref, and the per-job ref: overrides go
away because github.sha is already the tag commit.

Note: these jobs use no actions/cache, and dispatch already required
write access, so the practical risk was low — removing the taint
source was simply cheaper than six dismissals. Tags cut before this
change still carry the old workflow file and need -f tag= to
rehearse; RELEASING.md says so.

Scorecard Pinned-Dependencies #778–#780 (Dockerfile)

• FROM ubuntu:noble digest-pinned, plus a docker Dependabot entry.
• cargo-binstall and uv from SHA256-verified release tarballs instead
  of curl | bash (uv was not yet flagged; Scorecard reports one
  instance per rule, so it would have reopened the alert).
• Every binstall tool and npm global pinned to an exact version.

#780 will likely stay open — Scorecard wants a lockfile-driven
npm ci, which a global install cannot do — and should be dismissed
as won't-fix once this lands.

Not actionable

#781/#782 are stale clippy hits on the merged PR #1015 ref;
#783/#784 are already fixed.

make pre-commit: BCA_GATE: pass. A probe image exercised both new
tarball blocks on x86_64.