[M4n5ter]

Summary

Follow current stable CI tooling instead of freezing runtime and utility patch releases in workflow files. Node, npm, Zig and hosted runners use their rolling latest channels; Rust keeps stable and Python uses the latest stable 3.x. Select the distribution's libclang through llvm-config while preserving the release target and glibc baseline.

Official GitHub actions use supported major aliases. External actions retain ASF-required reviewed SHA pins: update taiki-e/install-action to reviewed v2.88.1 and retain the approved setup-zig v2.2.1 revision. The pinned installer bootstraps cargo-binstall, which then updates itself and installs current Cargo tools from the live registry, rather than relying on the installer's frozen tool manifest. Daily grouped Dependabot updates cover both default and rust-preview branches, including new action majors.

Keep the existing verified releases/latest mbx installation. Cargo target cache keys are independent of mbx version, so updating mbx does not discard compatible compiler output.

Verification

• Nine changed workflows pass actionlint 1.7.12; duplicate YAML keys and extracted shell syntax were checked.
• Biome and git diff --check pass.
• Current macos-latest maps to macOS 26 ARM64 with the required SDK; external action revisions were checked against the ASF allowlist and the taiki update was reviewed.
• Runner installation, release matrices, and cross-run cache behavior require GitHub execution; no measured speedup is claimed.

AI use

OpenAI Codex researched the current releases and policies, reviewed the installer update, and implemented these changes.

Generated-by: OpenAI Codex