ci(gha-tokens): read-only workflow tokens, no saved checkout credentials, SHA-pinned actions

[goodlime]

Implementation: read-only workflow tokens, no saved checkout credentials, SHA-pinned actions

SDD Task: github-actions-token-hardening

What was implemented

Today a job without its own permissions: block gets the org's write-capable GITHUB_TOKEN, and actions/checkout saves the token it used into .git/config, where any later step (including npm ci install scripts) can read it. This PR changes all three workflows (+52/−14):

• ci.yml: new top-level permissions: contents: read. Its one job, build-and-test, runs npm ci and now gets a read-only token.
• pages.yml: the top level keeps only contents: read. pages: write and id-token: write move to the deploy job, which runs no project code. The build job, which runs npm ci and builds the demo, is now read-only.
• publish.yml: split into two jobs:
  • build is read-only. It runs npm ci and npm run build:lib, then uploads dist/grapesjs-angular as an artifact.
  • publish keeps contents: write (for gh release create) and id-token: write (for npm provenance). It installs nothing: it downloads the built package and runs npm publish --ignore-scripts.
• No saved credentials. persist-credentials: false on every checkout. Nothing here needs one: the release step authenticates through GH_TOKEN in its own environment.
• SHA pins. Every action is pinned to a commit hash with its version as a comment.

No workflow here mints an App token, and this repo has no Claude review workflow, so no review runs on this PR.

Canary: ilqk8s-cluster-addons #199 shipped the same pattern first; it merged and was proven on #200.

What this PR's checks will and won't exercise

• build-and-test (ci.yml) runs for real: npm ci, the library build and its tests, with the read-only token and no saved credential.
• On merge to main, ci.yml runs again and pages.yml builds and deploys the demo. That is the first real run of the deploy job's own permissions block.
• publish.yml is not exercised. It runs only when a v*.*.* tag is pushed, so the build → publish split is first tested at the next release.

SDD Traceability

Artifact	Link
Spec PR	pending — added as a comment after spec PR is created
Spec folder	specs/active/github-actions-token-hardening/

Review

Approved on 2026-10-04 — 0 blocking issues.

Checklist

• All design.md tasks for this repo implemented
• Checks passing locally (actionlint and the spec's workflow checker exit 0)
• No [BLOCKING] items left open in review.md
• Branch synthesized from up-to-date origin/main

[goodlime]

Spec PR: https://github.com/internetliquid/ilqk8s-sdd-specs/pull/229