Harden reusable workflow trust and checkout credentials

[woksin]

Problem

The final Components 4 security review found no release-blocking vulnerability, but identified pre-existing GitHub Actions defense-in-depth gaps outside the V4 source tranche:

• reusable Cratis/Workflows callers track @main instead of an immutable reviewed commit;
• several thin caller workflows grant broader permissions than their visible local steps suggest;
• JavaScript jobs use checkout's default credential persistence before producing explicit reports/evidence artifacts;
• consumer-matrix jobs install exact test dependencies dynamically, which should remain bounded and auditable.

The current release workflow is still permissions-empty and fail-closed. This issue must not weaken that boundary or become publication authorization.

Direction

• Inventory every local and reusable workflow's effective permissions, including called-workflow requirements.
• Pin reusable workflow references to reviewed immutable SHAs, or document and test a deliberate centrally-updated trust policy.
• Set persist-credentials: false on checkouts that never push, and prove uploaded artifacts cannot include .git, npm credentials, or caller secrets.
• Reduce top-level and job-level permissions to the exact scopes each caller/callee needs.
• Keep consumer matrix installations exact-versioned, lock/matrix-derived, script-disabled where applicable, and isolated in temporary directories.
• Preserve SHA-pinned third-party actions, the read-only release-evidence job, and the manual permissions-empty failing publisher.

Acceptance criteria

• Zizmor reports no unexplained excessive-permission or credential-persistence findings.
• Every reusable workflow reference is immutable or covered by a reviewed, documented trust exception.
• Every checkout used only for verification disables credential persistence.
• Artifact inventories explicitly exclude repository credentials and package-manager auth files.
• Consumer fixtures retain strict peer validation and exact versions without gaining repository or publication credentials.
• Publication remains disabled and issue Prepare owner-authorized Components 4 publication #207 remains the only owner-authorized publication project.