ci: harden and enable Linux validation

[edgepillar]

Summary

• register the inherited Linux CI workflow in this fork
• add manual dispatch for branch-specific validation
• set the workflow token to explicit read-only repository access
• prevent checkout from persisting credentials
• pin third-party actions to immutable commit SHAs
• use the current Node 24-based checkout release
• cancel superseded runs for the same workflow and ref
• keep the web middleware guards clean under the current stable Clippy without changing their responses

Validation

• workflow YAML parsed successfully
• cargo fmt --all -- --check
• cargo clippy -p loupe-web --all-targets --all-features -- -D warnings
• cargo test -p loupe-web --lib (42 passed)
• git diff --check
• Linux GitHub Actions validation was triggered for the latest commit

Privacy and security

The workflow uses no repository secrets, credentials, personal identifiers, or local filesystem paths. Its GITHUB_TOKEN permission is limited to contents: read.