ci: test the no-alloc build and harden the workflow

Run clippy, docs and tests for tines-core with --no-default-features,
gating the MemStore-based tests on `alloc` so they compile there. Fail on
rustdoc warnings, pass --locked everywhere, and pin the toolchain to
1.99.0. In the workflow, use read-only permissions, cancel superseded
runs, add a 20-minute timeout, and pin actions to commit SHAs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/check-no-std.sh

@@ -1,4 +1,7 @@
 #!/bin/sh
 set -e
-rustup target add thumbv7em-none-eabihf
-cargo build -p tines-core --no-default-features --target thumbv7em-none-eabihf
+target=thumbv7em-none-eabihf
+if ! rustup target list --installed | grep -qx "$target"; then
+    rustup target add "$target"
+fi
+cargo build --locked -p tines-core --no-default-features --target "$target"