ci: fix matrix stride, pin actions, add timeouts

[dev-jodee]

• Fix matrix slicing stride: jobs sliced with hardcoded
  MIN_PROJECTS_PER_JOB while the matrix was sized with the computed
  projects_per_job, silently skipping projects once a project type
  crosses 256 directories. Slicing now uses the computed value.
• Cancel superseded in-progress runs on PR pushes (concurrency groups).
• Add timeout-minutes to every job so a hung validator cannot run to
  the 6-hour ceiling.
• Add least-privilege top-level permissions (contents: read).
• Pin third-party actions (dorny/paths-filter, pnpm/action-setup,
  extractions/setup-just, heyAyushh/setup-solana,
  dtolnay/rust-toolchain) to full commit SHAs; upgrade solana-asm's
  paths-filter from v3 to the same pinned v4 used elsewhere.

---

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

[greptile-apps]

Greptile Summary

The PR hardens and bounds CI execution while correcting dynamic matrix sharding.

• Uses the computed projects-per-job value consistently when generating and consuming framework build matrices.
• Adds workflow concurrency cancellation, least-privilege token permissions, and per-job timeouts.
• Pins third-party actions to commit SHAs and aligns the ASM path filter with v4.

Confidence Score: 5/5

The PR appears safe to merge with no concrete changed-code failures identified.

The computed shard width is emitted for every buildable project count and consumed consistently, while the permission, concurrency, timeout, and action-pinning changes preserve the existing workflow paths.

Important Files Changed

Filename	Overview
.github/actions/setup-anchor/action.yml	Pins the Solana setup action without changing its inputs or setup flow.
.github/workflows/anchor.yml	Corrects dynamic shard slicing and adds bounded, least-privilege CI execution.
.github/workflows/just.yml	Adds concurrency, permissions, timeouts, and immutable third-party action references.
.github/workflows/rust.yml	Bounds formatting and lint jobs and preserves the stable toolchain explicitly while pinning its action.
.github/workflows/solana-asm.yml	Aligns path filtering with sibling workflows and corrects dynamic matrix slicing.
.github/workflows/solana-native.yml	Corrects dynamic project sharding and adds CI hardening controls.
.github/workflows/solana-pinocchio.yml	Corrects dynamic project sharding and adds CI hardening controls.
.github/workflows/typescript.yml	Adds bounded, cancellable execution and pins pnpm setup.

_{Reviews (1): Last reviewed commit: "ci: fix matrix stride, pin actions, add ..." | Re-trigger Greptile}

[dev-jodee]

Superseded by a single combined PR.