Pin setup-zig GitHub Action to immutable SHA

[viyatb-oai]

Motivation

• Pinning the action to an immutable commit SHA reduces the risk of arbitrary code execution in runners with repository access and secrets.

Description

• Replaced uses: mlugg/setup-zig@v2 with uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2 in three workflow files.
• Updated the following files: .github/workflows/rust-ci.yml, .github/workflows/rust-release.yml, and .github/workflows/shell-tool-mcp.yml to reference the immutable SHA while preserving the original v2 intent in a trailing comment.

Testing

• No automated tests were run because this is a workflow-only change and does not affect repository source code, so CI validation will occur on the next workflow execution.

---

Codex Task