ci: harden GitHub Actions workflows

[flavorjones]

Summary

• Add zizmor and actionlint CI job
• Configure dependabot with batched updates and cooldown periods
• Pin all GitHub Actions to SHA hashes
• Suppress unpinned-images for service containers
• Fix excessive-permissions and artipacked findings
• Scope all permissions to job-level

Test plan

• CI passes (lint-actions job runs clean)
• Existing test jobs unaffected

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR hardens the repository’s CI by scoping GitHub Actions permissions, pinning action dependencies, and adding automated workflow auditing plus Dependabot configuration.

Tip

If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

Changes:

• Add workflow-level permissions: {} and job-level least-privilege permissions, plus disable checkout credential persistence.
• Introduce a new lint-actions job that runs actionlint and zizmor.
• Add .github/dependabot.yml to manage GitHub Actions and Bundler updates (with grouping and pacing configuration).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
.github/workflows/build.yml	Pins actions to SHAs, scopes permissions, adds workflow auditing, and annotates service container image pinning exceptions.
.github/dependabot.yml	Adds Dependabot configuration for GitHub Actions and Bundler dependencies.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.