ci: lock PR dependencies and check upstream compatibility weekly

[lovasoa]

Use --locked for all 24 build, test and Clippy commands in PR/main CI so dependency resolution cannot silently change the committed baseline. Document that dependency changes must include their lockfile updates.

Add a separate weekly/manual Upstream compatibility workflow that runs cargo update and exercises Clippy, core unit tests and SQLite type tests on latest stable for both TLS backends. Its explicit RUSTUP_TOOLCHAIN=stable overrides the shared toolchain pin proposed in #63. It has read-only repository permissions, never commits the generated lockfile and does not run on pull requests.

Validation:

• Parsed both workflow files and checked all 45 shell steps with bash -n.
• Verified every existing build/test/Clippy command uses --locked and compatibility runs only on schedule/manual dispatch.
• cargo metadata --locked --offline --no-deps --format-version 1 passed.
• The existing CI Clippy commands and SQLite time tests were exercised with --locked while validating fix(sqlite): avoid deprecated time format components #62.

Independent PR based on main. Merge #62 first to resolve the existing time deprecation errors; this PR does not change dependency versions. The scheduled workflow's fresh dependency resolution and full test run will be validated when it runs.