ci: harden workflows and add MIT license - #40

Summary

• deny GITHUB_TOKEN permissions by default and grant each workflow job only the permissions it uses
• pin every external action to the full SHA behind its existing v7 ref, retaining version comments
• add the canonical MIT license declared by package.json, with the repository's 2018 origin and author
• leave workshop code, dependencies, branches, and repository settings unchanged

Validation

• all workflow YAML parsed successfully
• all external action refs are full 40-character SHAs; no floating refs remain
• checkout SHA matches v7/v7.0.1 and setup-node SHA matches v7/v7.0.0
• LICENSE matches GitHub's canonical MIT template after substituting 2018 Mark Stuart
• npm ci --no-audit --no-fund
• node --check over all 2 JavaScript source files
• git diff --check