Audit GitHub Actions, CI/CD, workflows, and repository settings

[wimaan3]

Problem

Before going public, our automation surface (GitHub Actions, the CI/CD gate, workflows) and repo settings need a security + correctness audit. Workflows are an execution surface and a common supply-chain attack vector.

Scope

• Workflows (.github/workflows/): pin actions to commit SHAs (not tags), set least-privilege permissions: on GITHUB_TOKEN, review pull_request vs pull_request_target usage, untrusted-input handling, and secrets exposure.
• CI/CD: confirm the gate runs on every PR + push, fetch-depth correctness (identity check needs full history), no skippable/soft checks, artifact/log hygiene.
• Actions settings: who can run workflows, fork-PR approval policy, allowed actions list, OIDC, Dependabot for actions.
• Repo settings: default branch, merge options (squash/merge), branch protection (cross-ref Branch protection on main (require the gate) #60), required reviews, secret scanning / push protection, visibility safeguards before public flip.

Acceptance criteria

• A documented audit of workflows + Actions + repo settings with findings and severities.
• Actions pinned to SHAs; GITHUB_TOKEN permissions minimized.
• Settings hardened (or tracked as sub-tasks); pre-public go/no-go items flagged.
• Dependabot covering GitHub Actions.

Relates to: #60 (branch protection), #58 (supply chain), #11/#57 (secrets), #59 (exposure review).