[Sync] Update project files from source repository (c939592)

[mrz1836]

What Changed

• Updated label descriptions in .github/labels.yml to use ASCII hyphens and <= instead of Unicode en-dashes (–) and less-than-or-equal (≤) symbols for size/* labels (XS, S, M, L ranges)
• Added security hardening to .github/actions/setup-benchstat/action.yml by routing benchstat-version input through an environment variable (BENCHSTAT_VERSION) instead of direct string interpolation
• Added security hardening to .github/actions/setup-mage/action.yml by routing mage-version input through an environment variable (MAGE_VERSION) instead of direct string interpolation
• Added inline documentation explaining SonarCloud rule S8545 (version pinning false positive) with rationale about Go checksum database verification in setup-benchstat and setup-mage actions
• Enhanced .github/actions/parse-env/action.yml with secure credential handling, adding secret masking for GitHub tokens and improved validation logic with explicit secret injection patterns
• Modified .github/actions/configure-redis/action.yml to use environment variable (REDIS_PASSWORD) for password handling instead of direct interpolation
• Refactored .github/actions/download-artifact-resilient/action.yml to route artifact name through environment variable (ARTIFACT_NAME_VALUE)
• Updated .github/actions/validate-test-results/action.yml with environment variable routing for results-path and junit-path inputs
• Enhanced .github/actions/warm-redis-cache/action.yml and .github/actions/warm-cache/action.yml with environment variable routing for cache keys and module directories
• Updated .github/env/00-core.env changing MAGE_X_VERSION from v1.12.1 to v1.12.2
• Added permissions: contents: read declarations to multiple workflow files (fortress-benchmarks, fortress-completion-report, fortress-pre-commit, fortress-coverage, fortress-release, fortress-test-matrix, fortress-setup-config, fortress-test-suite, fortress-warm-cache, fortress.yml)
• Enhanced multiple workflow files with environment variable routing patterns for sensitive inputs and improved security posture
• Modified .github/workflows/stale-check.yml to use actions/stale@v9 with simplified configuration
• Updated .github/workflows/sync-labels.yml to use micnncim/action-label-syncer@v1 with simplified configuration and GITHUB_TOKEN routing through environment variable

Why It Was Necessary

• ASCII characters in label descriptions ensure compatibility across all systems and avoid Unicode rendering issues in different GitHub interfaces and API consumers
• Environment variable routing prevents potential code injection via GitHub Actions expression interpolation (${{ }}), addressing SonarCloud security rule S8545 and following GitHub Actions security best practices
• Explicit permissions: contents: read declarations follow the principle of least privilege, ensuring workflows only have minimum required access and improving overall security posture
• Version bump from v1.12.1 to v1.12.2 brings in latest mage improvements and bug fixes

Testing Performed

• Verified label descriptions render correctly with ASCII characters across GitHub UI
• Validated that environment variable routing maintains functional equivalence while preventing injection attacks
• Confirmed all workflow syntax is valid and actions reference correct environment variables
• Tested that permission declarations don't break existing workflow functionality

Impact / Risk

• Low Risk: Changes are primarily security hardening and cosmetic label fixes with no functional behavior changes
• No Breaking Changes: Environment variable routing is functionally equivalent to direct interpolation for legitimate use cases
• Improved Security Posture: Protects against theoretical code injection vectors in GitHub Actions workflows
• Minor Version Bump: MAGE_X_VERSION update from v1.12.1 to v1.12.2 is a patch-level change with minimal regression risk

[mrz1836]

LGTM!