ci: pin Rust toolchain, update actions, add audit and JS checks

- Add rust-toolchain.toml pinning to 1.85 (MSRV for edition 2024)
- Update actions/checkout from v2 to v4
- Remove manual rustfmt/clippy install (now declared in rust-toolchain.toml)
- Add cargo audit step for dependency vulnerability scanning
- Add node --check for web extension JS syntax validation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: phelix001

.github/workflows/main.yml

@@ -17,10 +17,9 @@ jobs:
     name: Build
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
 
       - run: rustup show active-toolchain
-      - run: rustup component add rustfmt clippy
 
       - name: Configure Rust cache
         uses: Swatinem/rust-cache@v2
@@ -64,3 +63,11 @@ jobs:
 
       - name: Check formatting
         run: cargo fmt --all --check
+
+      - name: Audit dependencies
+        run: |
+          cargo install cargo-audit --locked
+          cargo audit
+
+      - name: Validate web extension JS syntax
+        run: node --check webext/add-on/*.js

CLAUDE.md

@@ -17,6 +17,7 @@ See [ARCHITECTURE.md](/ARCHITECTURE.md) for the full design and code map.
 ## Build System
 
 Uses **Meson + Ninja + Cargo** (not plain `cargo build`).
+Rust toolchain pinned to **1.85** via `rust-toolchain.toml` (MSRV for edition 2024).
 
 ```shell
 # Setup

rust-toolchain.toml

@@ -0,0 +1,3 @@
+[toolchain]
+channel = "1.85"
+components = ["rustfmt", "clippy"]