Cherry-pick release pipeline security hardening

[nedtwigg]

Summary

• Pin GitHub Actions to commit SHAs and set explicit workflow permissions.
• Gate VS Code publishing behind a protected GitHub environment.
• Add CI artifact attestations plus local attestation/hash verification before signing.
• Make release artifact selection strict and harden release-tool command resolution.
• Generate an ephemeral CI-only Tauri updater key instead of relying on the production signing secret in CI.
• Add Dependabot coverage for GitHub Actions, npm, and Cargo.

Testing

• git diff --check passed.
• bash -n scripts/sign-and-deploy.sh passed.
• Workflow and Dependabot YAML parsed successfully.