ci: overhaul workflows — typecheck, hardening, caching, unified setup

.github/.workspace-ignore

@@ -0,0 +1,56 @@
+# Crates outside the root Cargo workspace, so rust.yml fmt/clippy do not cover them.
+# New crates must join [workspace] members in Cargo.toml or be listed here with a reason.
+# One directory path per line; comments and blank lines are ignored.
+basics/cross-program-invocation/native/programs/hand
+basics/cross-program-invocation/native/programs/lever
+basics/favorites/anchor/programs/favorites
+compression/cnft-burn/anchor/programs/cnft-burn
+compression/cnft-vault/anchor/programs/cnft-vault
+compression/cutils/anchor/programs/cutils
+games/world-cup/pinocchio/clients/rust
+games/world-cup/pinocchio/program
+games/world-cup/pinocchio/tests/integration-tests
+oracles/pyth/anchor/programs/pythexample
+tokens/create-token/anchor/programs/create-token
+tokens/create-token/native/program
+tokens/escrow/anchor/programs/escrow
+tokens/escrow/native/program
+tokens/external-delegate-token-master/anchor/programs/external-delegate-token-master
+tokens/nft-minter/anchor/programs/nft-minter
+tokens/nft-minter/native/program
+tokens/nft-operations/anchor/programs/mint-nft
+tokens/pda-mint-authority/anchor/programs/token-minter
+tokens/pda-mint-authority/native/program
+tokens/spl-token-minter/anchor/programs/spl-token-minter
+tokens/spl-token-minter/native/program
+tokens/token-2022/basics/anchor/programs/basics
+tokens/token-2022/cpi-guard/anchor/programs/cpi-guard
+tokens/token-2022/default-account-state/anchor/programs/default-account-state
+tokens/token-2022/group/anchor/programs/group
+tokens/token-2022/immutable-owner/anchor/programs/immutable-owner
+tokens/token-2022/interest-bearing/anchor/programs/interest-bearing
+tokens/token-2022/memo-transfer/anchor/programs/memo-transfer
+tokens/token-2022/metadata/anchor/programs/metadata
+tokens/token-2022/mint-close-authority/anchor/programs/mint-close-authority
+tokens/token-2022/nft-meta-data-pointer/anchor-example/anchor/programs/extension_nft
+tokens/token-2022/non-transferable/anchor/programs/non-transferable
+tokens/token-2022/permanent-delegate/anchor/programs/permanent-delegate
+tokens/token-2022/transfer-fee/anchor/programs/transfer-fee
+tokens/token-2022/transfer-hook/account-data-as-seed/anchor/programs/transfer-hook
+tokens/token-2022/transfer-hook/allow-block-list-token/anchor/programs/abl-token
+tokens/token-2022/transfer-hook/counter/anchor/programs/transfer-hook
+tokens/token-2022/transfer-hook/hello-world/anchor/programs/transfer-hook
+tokens/token-2022/transfer-hook/pblock-list/cli
+tokens/token-2022/transfer-hook/pblock-list/pino/cli
+tokens/token-2022/transfer-hook/pblock-list/pino/program
+tokens/token-2022/transfer-hook/pblock-list/pino/sdk/rust
+tokens/token-2022/transfer-hook/pblock-list/program
+tokens/token-2022/transfer-hook/pblock-list/sdk/rust
+tokens/token-2022/transfer-hook/transfer-cost/anchor/programs/transfer-hook
+tokens/token-2022/transfer-hook/transfer-switch/anchor/programs/transfer-switch
+tokens/token-2022/transfer-hook/whitelist/anchor/programs/transfer-hook
+tokens/token-fundraiser/anchor/programs/fundraiser
+tokens/token-swap/anchor/programs/token-swap
+tokens/transfer-tokens/anchor/programs/transfer-tokens
+tokens/transfer-tokens/native/program
+tools/shank-and-solita/native/program