[tyvsmith]

• restore .star builds blocked by npm 1.1.6 rejecting --source-commit and lacking sign
• build both workflows from a pinned Millennium revision with its Cargo lockfile; retain source provenance and production signing
• exercise store packaging, metadata and disposable-key signing against a code-and-assets fixture and Steam Native Notifications

Refs tyvsmith/steam-native-notifications#56

[Copilot]

🟢 Approval recommended

No active review issues are reported for the shared Starlight installer and workflow updates.

No open issues 🎉

What changed in this PR

Restores .star builds by replacing the npm Starlight installation with a pinned Millennium source revision that supports source provenance and production signing.

Changes:

• Adds a shared installer using cargo install --locked with an immutable source revision.
• Updates PR and production workflows to set up Rust and use the installer for .star builds, leaving other build formats unchanged.

File	Description
scripts/​build/​install-starlight.sh	Installs pinned Starlight with its Cargo lockfile and adds it to the workflow PATH.
.github/​workflows/​pr.yml	Sets up Rust and uses the shared installer for PR .star builds.
.github/​workflows/​ci.yml	Sets up Rust and uses the shared installer for production .star builds.

_{Review effort: Balanced}