Harden GitHub Actions workflows

[shunichironomura]

Summary

• apply least-privilege workflow permissions
• disable checkout credential persistence
• prevent template injection by passing values through environment variables
• scope Homebrew push credentials to the push step

Validation

• just lint
• just test
• zizmor . (no findings)