chore: harden cascade repo against OSSF Scorecard findings

[joshua-temple]

Repo-only Scorecard hardening (no generator-default change; PR #251 shipped the generator least-privilege permissions).

• Set pin_mode: sha in this repo's own manifest and regenerate, SHA-pinning actions/checkout (verified @df4cb1c = v6.0.3) in orchestrate and promote (PinnedDependencies). The repo's own setup-cli action stays version-pinned by cli_version.
• Digest-pin both Dockerfile base images; docker build verified against the pinned digests (PinnedDependencies).
• Add least-privilege permissions to the hand-authored release.yaml and hotfix.yaml: top-level contents: read, write only on the jobs that cut a release or push to trunk (TokenPermissions).
• Bump golang.org/x/crypto to v0.52.0 in the e2e module to clear the reachable ssh advisories govulncheck confirmed; the remaining alert entries are not-called or std-lib and are handled by dismissal.
• Add a FuzzLoadManifest native fuzz target on the manifest parse-and-validate path (Fuzzing).

Verification: go build/test ./... (1684 pass), golangci-lint clean, e2e build/vet clean, cascade verify clean, docker build succeeds on the pinned bases. schema_version unchanged.