Tighten CI stability with pinned actions and reduced permissions

[mvanderkamp]

Description

• Enable cancellation of superseded CI runs per branch or pull request.
• Use  npm ci --ignore-scripts  to avoid duplicate builds triggered by the  prepare  lifecycle script.
• Reduce job permissions to explicit  contents: read .
• Pin checkout, Node setup, and Coveralls actions to immutable commit SHAs.

Type of Change

• 🐛 Bug fix (non-breaking change fixing an issue)
• ✨ New feature (non-breaking change adding functionality)
• 💥 Breaking change (fix or feature causing existing functionality to change)
• 🧹 Chore / Refactor (code cleanup, npm package updates, linting)