fix: address current agnix queue

[avifenesh]

Summary

• update all tracked tool-release baselines after reviewing the current upstream releases
• add Claude Code 2.1.224 settings and credential-masking validation, and accept Codex 0.147 dotted plugin names
• roll up the pending Rust dependency and GitHub Action updates with synchronized lockfiles, pins, docs, locales, and generated rule metadata

Validation

• cargo test --workspace --all-features
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo deny check
• cargo fmt --all -- --check
• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12
• node scripts/sync-rule-bookkeeping.js --check
• scripts/check-locale-sync.sh
• python3 scripts/check-rule-counts.py
• env -u GLM_API_KEY UPDATE_BASELINES=true scripts/check-tool-releases.sh (12 current, 0 new)
• focused Claude settings and Codex plugin test suites
• generated all 447 documentation pages locally; the full pinned Node 20 Docusaurus build is left to CI after the high-core local build exceeded practical memory limits

Closes #1316
Closes #1317
Closes #1318
Closes #1319
Closes #1323
Closes #1324
Closes #1325
Closes #1326
Closes #1327

[revuto-review]

This is an auto review done by revuto.

---

Found one false-negative in the new credential validation and one evidence/version mismatch in the Codex rule metadata.

[revuto-review]

This is an auto review done by revuto.

---

Found one remaining scope false-negative in the new AWS credential validation.

[revuto-review]

This is an auto review done by revuto.

---

Found one remaining schema false negative in the new AWS credential-pair validation.

[revuto-review]

This is an auto review done by revuto.

---

Found one i18n regression in the new AWS credential diagnostics.

[avifenesh]

Superseded by #1338 on the identical validated head ea1cfb47. The final Revuto run on this PR did not produce a code finding; its provider rejected the accumulated 1,128,122-token review prompt as over context. The replacement preserves the issue-closing contract while giving the required reviewer a fresh review surface.