ci: harden GitHub Actions workflows

[mstuart]

Summary

• deny GITHUB_TOKEN permissions by default and grant each job only the permissions it uses
• pin every external action to the full SHA behind its existing v7 ref, retaining version comments
• leave CodeQL default setup unchanged; no workflow added

Validation

• all workflow YAML parsed successfully
• all external action refs are full 40-character SHAs; no floating refs remain
• checkout SHA matches v7/v7.0.1 and setup-node SHA matches v7/v7.0.0
• git diff --check
• npm run lint
• npm run typecheck
• npm test (153 tests)
• npm run test:coverage:check (thresholds passed)
• npm run build