fix: unblock the v4.0.0 release (Windows build + clippy 1.96)

[afonsojramos]

The v4.0.0 release run failed on publish-win and the Lint CI was red. This branch fixes both so v4.0.0 can be cut cleanly.

What's fixed

• Windows release build (publish-win → Build win64): build.rs invokes pnpm, but on Windows the mise shims aren't on PATH, so the frontend build failed (failed to run pnpm: program not found). Now each publish job builds setup-ui in a dedicated step via mise exec -- pnpm (shim-independent) and sets DISCRAKT_SKIP_UI_BUILD=1 so the cargo build reuses the prebuilt dist/. Applied to linux/win/macos for consistency.
• Clippy 1.96: CI's stable rolled to 1.96.0, whose unnecessary_sort_by lint flagged pre-existing plex_auth.rs. Fixed via sort_by_key.
• Toolchain drift: added rust-toolchain.toml pinning 1.96.0 so local and CI clippy stay in sync.
• Pre-release safety: update-winget / update-homebrew now skip pre-releases, so beta tags can dress-rehearse the build without touching package managers.

Validated locally: mise exec -- pnpm run build produces dist/, DISCRAKT_SKIP_UI_BUILD=1 cargo build reuses it, clippy/fmt/tests clean on 1.96.0, actionlint clean.