Harden GitHub Actions and CI/CD permissions

[DenWin]

Parent: #31.

Current evidence

• Workflows use mutable major/version tags rather than immutable action commit SHAs.
• Test/lint jobs run bun install without --frozen-lockfile.
• Jobs have no explicit timeout-minutes.
• Docker build and merge jobs request contents:write, attestations:write, and id-token:write although the workflow does not currently create attestations.
• Trusted same-repository pull requests may push image digests.
• pull_request_target writes labels through an unpinned third-party action.
• Manual Docker-tag deletion uses ArchieAtkinson/remove-dockertag-action@v0.0.
• Shell scripts and workflow files lack dedicated actionlint/shell validation.

Required work

• Pin every third-party action to a full commit SHA with a readable version comment.
• Configure Renovate to update pinned action digests.
• Set workflow/job permissions to the minimum required.
• Separate pull-request build/validation from release publication.
• Ensure no pull-request workflow publishes images, writes packages, obtains OIDC tokens, or accesses secrets.
• Add timeout-minutes to every job.
• Use bun install --frozen-lockfile.
• Add actionlint and shell-script validation.
• Protect environment-backed release credentials and require approval where appropriate.
• Add explicit persist-credentials settings to checkout where writes are unnecessary.
• Add artifact retention and size policies.
• Add workflow concurrency that cannot cancel an active production release unexpectedly.
• Replace or independently validate low-trust/mutable marketplace actions.
• Enable dependency-review and appropriate code/security scanning.
• Record threat analysis for pull_request_target and workflow_dispatch inputs.

Supply-chain validation

• Generate provenance/attestations only in release jobs and only with required id-token permissions.
• Verify workflow cannot publish from an untrusted fork or arbitrary commit.
• Test representative permission failures.
• Review generated GITHUB_TOKEN scopes in job summaries.

Acceptance criteria

• All external actions are SHA-pinned and automatically maintained.
• PR workflows are read-only and secretless.
• Publish permissions exist only in protected release jobs.
• Frozen installs, timeouts, actionlint, and shell validation are enforced.
• Release cancellation/concurrency behavior is documented.
• Security scanning results are visible and have an escalation policy.
• A CI security review documents remaining trusted inputs and permissions.