fix: add permissions blocks and pin wrangler-action SHA (#35)

- Add explicit permissions (contents: read) to build-ui and
  get-credentials jobs (CodeRabbit/GHAS feedback)
- Pin cloudflare/wrangler-action to commit SHA da0e0dfe (v3)

Co-authored-by: Nick Bianchi <nick@jeanarlene.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: 3 people

.github/workflows/ci.yml

@@ -85,6 +85,8 @@ jobs:
 
   build-ui:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     needs:
       - workflow-secret-policy
       - secret-scan

.github/workflows/deploy-pages.yml

@@ -11,6 +11,8 @@ on:
 jobs:
   get-credentials:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     outputs:
       cloudflare_token: ${{ steps.creds.outputs.cloudflare_token }}
       account_id: ${{ steps.creds.outputs.account_id }}
@@ -53,7 +55,7 @@ jobs:
         working-directory: ui
 
       - name: Deploy to Cloudflare Pages
-        uses: cloudflare/wrangler-action@v3
+        uses: cloudflare/wrangler-action@da0e0dfe58b7a431659754fdf3f186c529afbe65 # v3
         with:
           apiToken: ${{ needs.get-credentials.outputs.cloudflare_token }}
           accountId: ${{ needs.get-credentials.outputs.account_id }}