build(deps): pin release Rust toolchain action

[rominf]

Summary

• Pin the release workflow's Rust toolchain setup action to the full commit SHA for v1.17.0.
• Replace the moving @v1 tag to align the release workflow with the repository's GitHub Actions supply-chain policy and its other toolchain setup steps.
• Risk: low — this preserves the action version already used elsewhere and changes only dependency resolution from a moving tag to an immutable commit.

This addresses the follow-up concern identified during review of #120.

Test plan

• Verified upstream tag v1.17.0 resolves to 166cdcfd11aee3cb47222f9ddb555ce30ddb9659.
• Ran the configured pre-commit checks for .github/workflows/release.yml, including YAML validation.
• Confirmed no actions-rust-lang/setup-rust-toolchain@v1 moving-tag references remain in .github/workflows.
• Confirmed the pre-push signature and DCO checks pass.

[volen-silo]

Review — LGTM ✅

Reviewed the single-line pin of actions-rust-lang/setup-rust-toolchain in release.yml. Independently verified all three test-plan claims:

• SHA correctness — v1.17.0 is a lightweight tag pointing directly at commit 166cdcfd11aee3cb47222f9ddb555ce30ddb9659 (confirmed via the upstream Git refs API). The pinned SHA is an exact match.
• Consistency — the @<sha> # v1.17.0 form matches all 16 other setup-rust-toolchain references already pinned across ci.yml, nightly.yml, demo-gifs.yml, and release.yml.
• Completeness — on main, release.yml:39 was the only remaining moving @vN tag in the whole .github/workflows/ tree. This PR pins the last one, so after merge there are zero moving-tag action references. actions/checkout is already fully pinned.

Scope is tight, description is accurate, low risk. No changes requested.