Harden GitHub Actions permissions and pinning

[kylymo]

Parent issue

Part of #885 — Update app's GitHub Apps and automation

Objective

Harden GitHub Actions usage and permissions.

Evidence

• Repository Actions policy currently allows all actions.
• SHA pinning is not required.
• .github/workflows/ci.yml uses mutable major tags such as actions/checkout@v4, actions/setup-node@v4, and pnpm/action-setup@v2.
• Workflow permissions are not explicitly declared.

Scope

• Review every workflow and third-party action.
• Pin third-party actions to reviewed commit SHAs or establish an approved alternative.
• Add least-privilege workflow permissions.
• Decide whether repository Actions policy should restrict allowed actions.
• Document exceptions and update procedure.

Acceptance criteria

• Every workflow has explicit permissions.
• Third-party actions are pinned or covered by an approved governance policy.
• Action allow-list policy is intentional and documented.
• CI remains green after hardening.

Out of scope

Replacing CI providers or redesigning application build steps.