[MotherSphere]

What changed

• Rust toolchain action (ci.yml test and MSRV jobs, release.yml build job): dtolnay/rust-toolchain moves from 89b1218 on the stable branch to e2a55d2 on master, the merge of upstream #187 "Safely handle action inputs", as in Resources templates/sign-and-publish-caller.yml. The stable branch is rebased onto every master commit, so a SHA pinned on it stops being reachable. Master requires a toolchain input, so the steps that relied on the branch default now say toolchain: stable. The MSRV step keeps its own toolchain read from Cargo.toml.
• Intel macOS architecture check (REL-6, release.yml): memorystick-macos-x86 is cross-built on an arm64 runner and skipped by the smoke test, so it was signed with no automated check. A new step, "Check the cross-compiled artifact's architecture", runs file on it and fails unless it reports x86_64. The smoke test condition now uses matrix.target != 'x86_64-apple-darwin', the same as the template.
• Template comments ported into release.yml: the note that release-type must not be set, why -R is needed on "Hold the release as a draft", why sign-and-publish is chained by needs:, the # organisation pin label on the shared workflow ref (still 619460ff), and the code-signing-policy note.
• Dependabot (.github/dependabot.yml): synced with Resources templates/dependabot.yml. The github-actions entry now ignores Project-Colony/Project-Colony-Resources*, so Dependabot never moves the organisation pin of the shared signing workflow for this repository alone. The cargo directory stays /src-tauri until the layout is flattened.

Verification

• All three YAML files parse (yaml.safe_load).
• dependabot.yml is identical to the template apart from the cargo directory.
• Every uses: in ci.yml and release.yml is pinned to a 40-character SHA.
• CI on this PR covers the toolchain change: test on Linux, Windows and macOS, MSRV, Colony themes and Document filter.
• The release-only architecture step runs on the next release. It uses the same file check as the template. The v0.1.0 memorystick-macos-x86 asset was already checked by hand and reports Mach-O 64-bit x86_64.