ci: support Ubuntu 26.04 runner validation #66

Problem

The Ubuntu 26.04 update in #61 runs on GitHub-hosted runners but fails the pinned Actionlint 1.7.12 runner-label check.
The CodeQL Actions matrix branch also retains Ubuntu 24.04 because its runner expression isn't a plain runner declaration.

Expected behavior

Use Ubuntu 26.04 for every existing Linux runner in the update, including the CodeQL Actions branch.
Preserve the Windows Rust analysis branch, the ordinary two-job CI gate, signed-source release qualification, and existing publication controls.
Add only the exact runner label to Actionlint's configuration.
Keep its version and diagnostics.

Scope

The change covers .github/actionlint.yaml and the runner declarations in .github/workflows/ci.yml, .github/workflows/codeql.yml, .github/workflows/dependency-review.yml, .github/workflows/release.yml, and .github/workflows/verify-doppler.yml.
The CodeQL edit also names its selection job, explains existing permissions, and uses rustup to install and select the same Rust 1.99.1 toolchain.
The file's existing workflow lint requires those adjacent corrections.
It includes no native implementation or release publication change.

Acceptance

The pinned Actionlint accepts the real workflows and still rejects an unrelated unknown runner label.
The ordinary local project gate passes, and the updated pull request passes its required hosted checks.
Hosted Linux and CodeQL Actions jobs report Ubuntu 26.04, while the Rust analysis job retains Windows 2022.
Release-only qualification remains outside the ordinary pull request and supplies no execution evidence until a release run.