[CI/CD] Make the CI and release toolchain immutable and reproducible

[fettpl]

Summary

Makes the remaining CI and release execution inputs reproducible on current dev: third-party actions use verified immutable SHAs, release tooling is installed from an exact root lockfile, and a zero-network policy gate prevents mutable workflow inputs from returning.

Closes #230

Maintainer rework addressed

This is a narrow replacement for closed PR #248, rebuilt from current dev. It preserves the exact Bun version, frozen installs, and exact-tested-revision release protections already present on dev, then adds only the remaining action/release-tool pinning and policy validation requested in the maintainer review.

Solution design

• Replace every remaining external uses: tag in CI, maintenance, and release workflows with the full commit SHA resolved from the action's official repository tag.
• Keep Node 22.19.0, Bun 1.3.14, frozen application installs, and the existing release-SHA dependency graph unchanged.
• Install semantic-release and its configured plugins as exact root development dependencies via npm ci --ignore-scripts.
• Invoke checked-in Playwright and semantic-release binaries instead of acquiring packages dynamically.
• Add a deterministic workflow-policy validator and table-driven tests covering mutable action references, container tags, floating runtime versions, dynamic package execution, and non-frozen installs.
• Run the policy in both the repository gate and CI.
• Add weekly, GitHub-Actions-only Dependabot updates for reviewable SHA refreshes.

Acceptance criteria

• Every external action reference uses a verified 40-character commit SHA.
• Node, Bun, and release-tool versions are exact and lockfile-backed.
• Controller and application installs remain frozen.
• Workflows contain no latest, mutable action tags, dynamic npx/bunx/npm exec, or non-frozen package installs.
• The zero-network policy gate is part of npm run check and CI.
• GitHub Actions Dependabot is configured without enabling unrelated ecosystems.
• Current dev's exact-revision release protections remain intact.

Validation

Validated exact head 184ef965e2395056b68f40bca9ccc19957d4f79c:

• workflow-policy suite: 14 tests passed and the repository policy passed;
• root npm ci --ignore-scripts: lockfile remained stable;
• configured release plugins loaded from the local exact dependency graph;
• npm run check: passed;
• npm run test:integration: 97 tests passed; and
• independent exact-head P0/P1 review found no actionable findings and verified every pinned action SHA against its official upstream tag.

Dependency review note

The root lockfile contains only development-scoped release tooling, and npm audit --omit=dev reports zero vulnerabilities. A full development audit reports transitive advisories in semantic-release's bundled, unused npm-publishing plugin; testing supported semantic-release majors found advisories in every graph, with the selected current exact version producing the smallest set. The exact pinned dependency-review action filters to runtime scope before vulnerability and license evaluation, the release config does not load the npm-publishing plugin, and installation uses --ignore-scripts. Dependabot remains the follow-up path when the upstream graph offers a supported clean release.

Scope and rollout

The change is limited to CI/release workflow references, the root release-tool lockfile, the workflow policy and its tests, and GitHub-Actions-only Dependabot configuration. It changes no application or frontend behavior, publishes no release, rotates no secrets, and does not alter the current release job graph. Future action updates should arrive through Dependabot and be checked against the official upstream tag before merge.

[fettpl]

@0xSero This ready replacement is rebuilt narrowly from current dev and addresses your #248 rework request while retaining the existing exact-Bun, frozen-install, and release-SHA protections. Exact head 184ef965e2395056b68f40bca9ccc19957d4f79c passed the 14-test workflow-policy suite, full repository and 97-test integration gates, normal pre-push hook, and independent P0/P1 review; all nine unique action SHAs were independently matched to official upstream tags. Please review when convenient and approve the fork workflows if GitHub presents an action-required gate.