chore: R-16 toolchain pin + reconciliation (#85)

Reconciles local R-16 history with origin per owner rulings
R-20/R-21/R-24/R-29. Pin conversion (.tool-versions -> .mise.toml) kept;
sweep rows reverted per the 2026-08-28 TSV.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Author: hyperpolymath

.github/dependabot.yml

@@ -10,7 +10,7 @@ updates:
     # `ignore: "*" patch` rule also silenced security PRs under GitHub\'s
     # current Dependabot behaviour. See rsr-template-repo commit 78b050e
     # and 007-lang/audits/audit-dependabot-automation-gap-2026-04-17.md.
-    open-pull-requests-limit: 10
+    open-pull-requests-limit: 3
     groups:
       cargo:
         patterns:
@@ -22,6 +22,7 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 2
     groups:
       actions:
         patterns:
@@ -30,15 +31,35 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 3
+    groups:
+      all-dependencies:
+        patterns:
+          - "*"
   - package-ecosystem: "nix"
     directory: "/"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 3
+    groups:
+      all-dependencies:
+        patterns:
+          - "*"
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 3
+    groups:
+      all-dependencies:
+        patterns:
+          - "*"
   - package-ecosystem: "pip"
     directory: "/"
     schedule:
-      interval: "weekly"
+      interval: "weekly"
+    open-pull-requests-limit: 3
+    groups:
+      all-dependencies:
+        patterns:
+          - "*"

.github/workflows/scorecard.yml

@@ -9,10 +9,11 @@ on:
 permissions:
   actions: read
   contents: read
-
+  security-events: write
+  id-token: write
 jobs:
   scorecard:
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236
     permissions:
       contents: read
       security-events: write

.github/workflows/workflow-linter.yml

@@ -11,6 +11,7 @@ on:
       - '.github/workflows/**'
 
 permissions: read-all
+  actions: read
 
 jobs:
   lint-workflows:

.mise.toml

@@ -0,0 +1,2 @@
+[tools]
+rust = "stable"