ci: harden GitHub Actions workflows

[mstuart]

Summary

• give the CI workflow explicit read-only repository contents permission
• pin checkout and setup-node to the verified commits behind their existing v7 refs
• retain v7 comments without upgrading action versions

Security impact

This removes reliance on repository-default token scopes and prevents external action tags from resolving to different code after review. Existing release and audit write permissions remain unchanged because those workflows require them.

Verification

• parsed all workflow YAML files
• verified every workflow has explicit permissions
• verified all external action refs are full 40-character SHAs with retained version comments and no floating refs
• npm run check
• npm test
• npm run build --if-present
• npm pack --dry-run