chore(dev): secure CI workflows

[2bndy5]

This hardens security for CI workflows.

• do not persist git credentials when git push is not used
• third-party actions are pinned to SHA (instead of a rolling major version tag)
• caching prevented in situations where poisoned caches might affect deployments
• explicitly remove any inherited (global) permissions for github.token
• explicitly grant github.token permissions where needed (per job). Includes explanatory comments.
• prevent caching installed executable binaries (via cargo [b]install)
• other Quality of Life improvements that don't change behavior
• add job (in pre-commit CI) to lint CI workflows using zizmor. Most of the above concerns were made to address zizmor warnings/errors.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.63%. Comparing base (3b0771a) to head (179cbd7).
⚠️ Report is 16 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #101   +/-   ##
=======================================
  Coverage   99.63%   99.63%           
=======================================
  Files          22       22           
  Lines        2734     2734           
=======================================
  Hits         2724     2724           
  Misses         10       10           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.