ci: modernize actions and avoid duplicate pull request builds

[DoodlesEpic]

Internal pull requests currently rebuild commits already tested on push. Run the shared desktop/performance workflow on internal pushes and fork PRs, skip internal PR builds, and cancel obsolete Test runs without affecting releases.

Update external Actions to verified stable commit SHAs, replace the obsolete Clippy workflow with required Linux formatting and Clippy checks, and let Tauri build the frontend once before Rust tests. Keep all four desktop targets, AppImage smoke tests, and performance release gates.

Replace automatic CodeQL setup with one explicit workflow for Rust, JavaScript/TypeScript, Python and Actions. Analyze PRs targeting dev/main, pushes to those branches, and weekly. Rust uses build mode none with native build-script dependencies. Keep the default query suite and document actual coverage limits.

Validation: Svelte check, lint, seven benchmark detector tests, and actionlint passed locally. Opening this PR skipped the duplicate Test build as intended. Desktop builds, benchmarks, and CodeQL run in CI. RELEASE_PLAN.md remains local and uncommitted.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.