ci: pin cargo-semver-checks by version and checksum

Download the v0.51.0 release binary directly and verify its SHA-256 instead
of installing whatever cargo-binstall and cargo-semver-checks are latest,
matching the SHA-pinned actions elsewhere in the workflows.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -44,11 +44,17 @@ jobs:
 
       # The semver gate in scripts/ci.sh compares tines-core against the
       # published 1.0.0; a prebuilt binary keeps this fast (a from-source
-      # install would dominate the job).
+      # install would dominate the job). Pinned by version and SHA-256, like
+      # the actions above; bump both together.
       - name: Install cargo-semver-checks
+        env:
+          CSC_VERSION: v0.51.0
+          CSC_SHA256: cacadafaa5cd27ae6d05a74a103266917ebab4c5e43c898360e177d4fbf06a65
         run: |
-          curl -LsSf https://github.com/cargo-bins/cargo-binstall/releases/latest/download/cargo-binstall-x86_64-unknown-linux-musl.tgz | tar xzf - -C "$HOME/.cargo/bin"
-          cargo binstall --no-confirm cargo-semver-checks
+          curl -fsSLo csc.tar.gz "https://github.com/obi1kenobi/cargo-semver-checks/releases/download/${CSC_VERSION}/cargo-semver-checks-x86_64-unknown-linux-gnu.tar.gz"
+          echo "${CSC_SHA256}  csc.tar.gz" | sha256sum -c -
+          tar xzf csc.tar.gz -C "$HOME/.cargo/bin" cargo-semver-checks
+          rm csc.tar.gz
 
       - name: Run CI gate
         run: sh scripts/ci.sh