Harden GitHub Actions dependencies and permissions

[andrewiggins]

What changed

This updates the GitHub Actions used by the repository and pins each external action to a reviewed commit. It also adds a seven-day delay before Dependabot proposes newly released action versions.

Future GitHub Action updates will be grouped into one pull request. Dependabot will keep Changesets on v1 until the repository deliberately upgrades to Changesets CLI v3.

The workflows now declare the permissions they need instead of inheriting the repository's broad defaults. Checkout credentials are no longer left available to later steps.

The custom GitHub App token is now used only by Changesets, where it is needed so updates to the release PR trigger the usual checks. Preview publishing and Snapit use the job's built-in GitHub token.

The workflows continue to use ubuntu-latest, and the maintenance policy is documented in CONTRIBUTING.md.

Validation

• Parsed all workflow and Dependabot YAML
• Ran repository lint, type checking, builds, unit coverage, and Playwright tests
• Verified every external action uses a 40-character commit SHA
• Verified the workflow permission matrix
• Verified all checkout steps disable credential persistence
• Verified Changesets is the only remaining custom-token call site

The protected release, preview, CLA, and Snapit event paths will be checked through their normal repository events after merge rather than simulated locally with production credentials.

No changeset is needed because this changes repository automation and documentation only.

[andrewiggins]

/snapit