Harden CI: credentials, permissions, pinned actions #84

Found in the 12 October security review (L2). The same issue is filed on the extension.

• actions/checkout: add persist-credentials: false wherever a job doesn't push.
• permissions:: set it at job level, least privilege (contents: read by default). Set contents: write only on the job that tags or releases.
• Pin third-party actions to a full commit SHA, with the version in a comment (actions/checkout@<sha> # v4.x). Add a Dependabot github-actions entry so the pins stay current.
• Reusable workflows from nyuchi/.github: pin to a SHA too, or document why a tag is acceptable.

Validate with actionlint, which is already in CI.