ci: move security/fuzz workflows to cachekit-lean runners

[27Bslash6]

Summary

• Move fuzz-smoke, security-medium, and security-deep compute jobs to cachekit-lean self-hosted runners
• Drop dtolnay/rust-toolchain and Swatinem/rust-cache actions (cross-device link errors on container overlay filesystems)
• Use plain rustup commands instead, consistent with cachekit-rs CI
• Set RUSTUP_HOME=/tmp/rustup and CARGO_HOME=/tmp/cargo (same-filesystem fix)
• Kani stays on ubuntu-latest (needs Docker container)
• Summary/report jobs stay on ubuntu-latest (trivial)
• Also fixes YAML indentation bugs from 09dc062 that broke all 3 workflows

What stays on ubuntu-latest

• kani-verification — pulls Docker container via kani-github-action
• generate-security-report / security-*-success — trivial shell scripts

Test plan

• All 3 YAML files pass check-yaml pre-commit hook
• fuzz-smoke workflow runs on cachekit-lean
• security-medium workflow runs on cachekit-lean
• security-deep nightly workflow runs on cachekit-lean