fix(ci): harden GitHub Actions workflows (#129)

[hf-security-analysis]

Summary

Release tag expressions were interpolated directly into shell scripts. A valid Git tag containing command substitution could execute shell code during tag validation. Pass tag, version and repository values through quoted environment variables instead, following GitHub guidance.

Use contents: read as the workflow default, including reusable-workflow callers. The PyPI job needs no GITHUB_TOKEN scopes because it downloads the same run's artifact and uses the existing PyPI API token; only the release-asset upload job retains contents: write. Disable checkout credential persistence and automatic Node package-manager caching in the release workflow.

Action references remain at their existing full commit SHAs. The version-comment updates do not fix previously unpinned actions; the original automated report overstated those findings.

Test plan

• Actionlint 1.7.12 validates all three modified workflows.
• Zizmor 1.30.1 offline audit: no medium/high findings in these workflows. Low/informational suggestions about local workflow references and trusted publishing remain separate.
• Local harmless injection reproduction: the old script creates a marker from a crafted valid Git tag; the new script rejects the tag without executing it. A normal version tag still passes.
• Verify all action references are unchanged, default/job permissions are consistent, and same-run artifact downloads do not require a GitHub API token.
• CI on the final revision, including Windows and Linux Python 3.12–3.14, docs, runtime contracts and wheel installation.

Out of scope

No runtime, dataset, package-version or published-release changes. PyPI credentials and authentication mode remain unchanged; this review does not perform another live publication. This does not establish that an external PR could trigger the release-only shell path, or that any compromise occurred.

Closes huggingface/tracking-issues#943

[adithya-s-k]

reviewed this and reproduced the tag-handling issue locally. i completed the workflow defaults and disabled saved checkout credentials / automatic release cache use. the action SHAs were already pinned, so i corrected that part of the description. workflow lint and the offline security checks pass; waiting on final CI before merging. no dataset or package release changes needed.

[adithya-s-k]

validated the final changes and all CI checks pass. the release-tag issue is reproducible and fixed; token permissions and credential handling are now explicit. no action SHA or package behavior changes. good to merge.

[adithya-s-k]

merged with the extra permission and credential hardening. all CI checks are green; the release scripts were also checked locally. no package release or dataset update needed.