CI supply chain: pin actions by SHA, CODEOWNERS, npm provenance, dispatch inputs via env #650

Found in the security audit (notes/SECURITY_AUDIT.md). The drop secrets on PR runs and the default permissions were fixed in the audit PR; these are what's left:

• Pin actions by SHA (actions/checkout, setup-bun, upload/download-artifact, Swatinem/rust-cache) and replace dtolnay/rust-toolchain@stable (a moving branch) with a pinned SHA plus a toolchain: input. Add .github/dependabot.yml for the github-actions ecosystem only, so the pins stay current without npm noise (the dependency doctor, codeSplitters dependency doctor: alert the owner when a dependency is exposed, and run it on RustyBuns' own deps #615, covers npm).
• CODEOWNERS for .github/, scripts/, **/.env.schema, **/rustybuns.config.ts, apps/codesplitters/src/{identity,tokens,oauth,deploy*,sandbox}.ts. It only bites with the ruleset's "require code owner review" (see the MANUAL RUN issue).
• workflow_dispatch inputs apps/version are interpolated into run: (desktop-drop.yml plan step); pass them through env:.
• npm provenance: publish from a workflow with npm trusted publishing (OIDC, no token) and --provenance, instead of publish:all from a laptop.
• bunfig.toml install.minimumReleaseAge (if the pinned Bun supports it) so a just-published hijacked release isn't installed.
• varlock is pinned at two versions (cli 1.21.1, codesplitters 1.22.0), and packages/cli/src/index.ts:357 prefers a node_modules/.bin/PATH varlock over the bundled one. Use the bundled one unless asked, since it's the process that receives the 1Password values.