fix(workflows): enforce private-free action boundary

[rldyourmnd]

Summary

• remove the unsafe conditional Harden-Runner toggle from cross-tier and private-free workflows
• keep Harden-Runner unconditional only in explicit public/GHAS workflows and update it to v2.20.0
• add a fail-closed lifecycle contract validator and hash-lock self-CI dependencies
• publish the breaking input-contract change as 0.4.0 metadata and update callers/documentation examples

Verification

• python3 scripts/validate_all.py
• actionlint -color
• uvx --from zizmor==1.26.1 zizmor --persona regular --min-severity low .github/workflows
• uv pip install --require-hashes -r requirements-ci.txt in an isolated Python 3.13 environment

Security rationale

Harden-Runner is a JavaScript action with pre/post entry points. A false step-level condition does not reliably prevent those lifecycle hooks, so private-free safety must be represented by absence of the action from the workflow file.