ci(tangled): add spindle workflows mirroring GitHub Actions
- rust.yml: cargo build/test/fmt/clippy on push and pull_request
- nix.yml: flake-based fmt/treefmt/deny/clippy/doc/test/build/static-musl
- security-audit.yml: manual cargo-deny advisories check
Spindle does not yet support scheduled triggers or matrix builds, so the
weekly security audit becomes manual and the architecture matrix from the
GitHub nix.yml is dropped (single arch on the spindle).
Workflows specific to GitHub services (codeberg mirror, snap publish,
release-plz) are intentionally not translated.
Assisted-by: Claude Opus 4.7 (code generation)