ci: test the no-alloc build and harden the workflow

Run clippy, docs and tests for tines-core with --no-default-features,
gating the MemStore-based tests on `alloc` so they compile there. Fail on
rustdoc warnings, pass --locked everywhere, and pin the toolchain to
1.99.0. In the workflow, use read-only permissions, cancel superseded
runs, add a 20-minute timeout, and pin actions to commit SHAs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

rust-toolchain.toml

@@ -1,2 +1,6 @@
 [toolchain]
-channel = "stable"
+# Pinned so new clippy lints or rustfmt rules can't break CI without a code
+# change. Bump deliberately, together with the version in ci.yml.
+channel = "1.99.0"
+components = ["rustfmt", "clippy"]
+targets = ["thumbv7em-none-eabihf"]