ci: standardize validation and centralize tool pins

[acgetchell]

• Compose CI from orthogonal leaf validators with one release-profile nextest pass and separate doctests.
• Resolve workflow tooling through the justfile and shared setup action.
• Document focused validation, notebook scope, and Rust 1.97 tooling policy.
• Refresh development tools, security actions, Dependabot schedules, and lockfiles.

Closes#167
Closes#189

Summary by CodeRabbit

• New Features

  • Added centralized setup and version validation for project development tools.
  • Added focused recipes for Rust, Python, benchmark, configuration, and documentation checks.
  • Added automated benchmark and integration test targets.

• Documentation

  • Updated contributor requirements and setup guidance for newer Rust, uv, and just versions.
  • Added guidance on warnings, linker diagnostics, lockfiles, and Rust compatibility.

• Chores

  • Updated security and analysis tooling to newer releases.
  • Improved CI scheduling and validation for more reliable checks.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 4f041083-e9b1-4f6b-be2d-dd529307710e

📥 Commits

Reviewing files that changed from the base of the PR and between f332160 and 54a7e3a.

⛔ Files ignored due to path filters (2)

• Cargo.lock is excluded by !**/*.lock
• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (14)

• .github/actions/setup-just/action.yml
• .github/dependabot.yml
• .github/workflows/audit.yml
• .github/workflows/benchmarks.yml
• .github/workflows/ci.yml
• .github/workflows/codecov.yml
• .github/workflows/codeql.yml
• .github/workflows/release-benchmarks.yml
• .github/workflows/rust-clippy.yml
• .github/workflows/semgrep-sarif.yml
• .github/workflows/zizmor.yml
• CONTRIBUTING.md
• README.md
• justfile

---

📝 Walkthrough

Walkthrough

The change centralizes pinned tool versions, adds a shared setup-just action, updates workflows to validate resolved versions, expands Just validation recipes, updates action schedules and pins, and documents the revised toolchain.

Changes

CI tooling and validation

Layer / File(s)	Summary
Justfile versions and validation recipes justfile	Updates tool pins and restructures benchmark, CI, language, formatting, parsing, YAML, TOML, and test recipes.
Shared just setup in workflows .github/actions/setup-just/action.yml, .github/workflows/*	Adds shared Just installation and validated tool-version resolution across benchmark, CI, coverage, Clippy, release, and Semgrep workflows.
Workflow pins and update schedules .github/dependabot.yml, .github/workflows/audit.yml, .github/workflows/codeql.yml, .github/workflows/zizmor.yml	Updates Dependabot schedules and pinned analysis action revisions.
Toolchain policy and contributor guidance CONTRIBUTING.md, README.md	Updates required tool versions and documents Rust 1.97 policies and validation procedures.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
participant Workflow
participant setup-just
participant Justfile
participant Installer
Workflow->>setup-just: invoke local action
setup-just->>Justfile: resolve just_version
setup-just->>Installer: install resolved Just version
Workflow->>Justfile: evaluate tool version
Justfile-->>Workflow: return validated version
Workflow->>Workflow: export step output

Loading

Possibly related issues

• Standardize orthogonal CI buckets and reusable notebook checker causal-triangulations#205 — Both changes restructure justfile CI validation and add focused Rust CI buckets.
• Upgrade notebook validation and flatten CI buckets markov-chain-monte-carlo#95 — Both changes flatten just ci dependencies and add a test-rust-ci bucket.

Possibly related PRs

• acgetchell/la-stack#121 — Earlier CI and tooling changes are extended by centralized Justfile versions and shared setup.
• acgetchell/la-stack#178 — Shares Justfile-based version resolution and benchmark workflow changes.
• acgetchell/la-stack#183 — Shares Rust MSRV and contributor toolchain documentation changes.

Suggested labels:dependencies, github-actions

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The PR addresses CI composition and tool centralization, but the required reusable notebook validation recipes are not evidenced.	Add notebook-lint, notebook-check, notebook-check-slow, and notebook-clear-outputs-all, and record all required Rust 1.97 audit conclusions.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the primary CI validation and tool-pin changes.
Out of Scope Changes check	✅ Passed	The reviewed workflow, documentation, dependency, security-action, and tool-version changes align with the stated CI and tooling objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/167-orthogonal-validation

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.86%. Comparing base (f332160) to head (54a7e3a).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@ Coverage Diff @@## main #202 +/- ##
=======================================
Coverage 97.86% 97.86% =======================================
Files 8 8 Lines 4969 4969 =======================================
Hits 4863 4863 Misses 106 106 

Flag	Coverage Δ
unittests	97.86% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.