fix: resolve zizmor GitHub Actions security findings

.github/workflows/check-pr-title.yaml

@@ -7,6 +7,8 @@ on:
       - edited
       - synchronize
 
+permissions: {}
+
 jobs:
   # Ensures that the PR title adheres to [conventional commits](https://www.conventionalcommits.org/en/v1.0.0/).
   conventional-commit:

.github/workflows/claude-code-review.yml

@@ -8,6 +8,8 @@ on:
   pull_request:
     types: [opened, synchronize, ready_for_review, labeled, unlabeled]
 
+permissions: {}
+
 jobs:
   claude-review-auto:
     if: |

.github/workflows/claude-pr-metadata-update.yml

@@ -22,6 +22,8 @@ concurrency:
   group: pr-metadata-${{ github.event.pull_request.number }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   generate-pr-metadata:
     # Skip conditions:

.github/workflows/monorepo-checks.yml

@@ -9,6 +9,8 @@ on:
       - synchronize
       - reopened
 
+permissions: {}
+
 jobs:
   build-and-test:
     name: Lint, Build, and Test
@@ -41,6 +43,7 @@ jobs:
         with:
           submodules: "recursive"
           fetch-depth: 2
+          persist-credentials: false
 
       - name: 💽 Node and Caching
         uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7

.github/workflows/monorepo-integrity.yml

@@ -8,6 +8,8 @@ on:
     branches:
       - main
 
+permissions: {}
+
 jobs:
   monorepo-integrity:
     name: Check monorepo integrity
@@ -36,6 +38,7 @@ jobs:
         with:
           fetch-depth: 2
           submodules: "true"
+          persist-credentials: false
 
       - name: 💽 Node and Caching
         uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7

.github/workflows/push-branches-from-main.yaml

@@ -5,6 +5,8 @@ on:
     branches:
       - main
 
+permissions: {}
+
 jobs:
   dev-branch-push:
     name: "Push to beta and alpha branches"
@@ -31,6 +33,7 @@ jobs:
         with:
           token: ${{ secrets.SERVICE_ACCOUNT_PAT }}
           ref: main
+          persist-credentials: false
 
       - name: Setup git
         run: |

.github/workflows/semantic-release.yaml

@@ -37,6 +37,7 @@ jobs:
         with:
           submodules: "true"
           fetch-depth: 2
+          persist-credentials: false
 
       - name: Setup Node
         uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7

.github/workflows/trufflehog.yml

@@ -39,6 +39,7 @@ jobs:
         uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: TruffleHog OSS
         id: trufflehog