Pin repo toolchain and locked Cargo workflows

[mother-6000]

Closes #224

Please check if the PR fulfills these requirements

• Tests for the changes have been added (for bug fixes / features)
• Docs have been added / updated (for bug fixes / features)
• CHANGELOG.md has been updated (for bug fixes / features / docs)

What kind of change does this PR introduce?

Security hardening / build and release configuration update.

What was changed?

• add a repo-owned rust-toolchain.toml pinned to Rust 1.91.0 and align Cargo.toml rust-version with the actual locked dependency floor
• make CI/build/test/publish flows use locked Cargo resolution instead of floating dependency resolution
• replace the tag validation cargo install cargo-get step with repo-local cargo metadata --locked version verification
• update pre-commit, contributor guidance, install docs, and changelog text to reflect the locked workflow
• keep the ReductStore integration-test image floating as approved in the issue thread

Related issues

• Parent tracking issue: Mitigation: Dependency/base image pinning and verification security#34
• Approved implementation plan: SSDLC mitigation: Dependency/base image pinning and verification #224 (comment)
• Plan revision for the Rust 1.91.0 compiler floor: SSDLC mitigation: Dependency/base image pinning and verification #224 (comment)

Does this PR introduce a breaking change?

No end-user CLI/API break.

Contributor/build environments now need Rust 1.91.0 for this repository because the current locked dependency graph already requires that compiler version.

Other information:

Local validation completed before opening the PR:

• RS_API_TOKEN=TOKEN cargo test --locked -- --test-threads=1
• cargo fmt --all --check
• cargo check --locked
• cargo build --release --locked
• cargo metadata --format-version 1 --no-deps --locked
• cargo publish -p reduct-cli --locked --dry-run --allow-dirty

I also re-checked the repo for this issue’s other control items:

• no tracked Dockerfile / FROM definitions to pin in this repository
• no tracked curl | sh-style installer patterns found

[mother-6000]

@reductstore/maintainers @reductstore/devops ready for review — the PR description links the approved plan revision and the local validation results.