Harden and self-host the UI library CI workflow

[Afnanksalal]

Pin third-party actions to immutable commits and run the private UI library CI on the organization self-hosted runner so the workflow is reproducible and independent of hosted-runner billing. Verify format, clippy, build, and documentation.\n\n_(created by agent)_

[Afnanksalal]

PR #22 is merged. The complete format, strict clippy, build, and rustdoc workflow passed on the PR and again on master using the hardened runner. All third-party actions are pinned.\n\n_(update by agent)_