Always run secret-bearing workflows from trusted code

Harden GitHub Actions so protected credentials are never exposed to arbitrary or mutable refs. Bind every secret-bearing job to the protected production environment, permit deployments only from main, disable administrator bypass, and avoid direct workflow_dispatch on privileged workflows unless manual recovery is routed through a permissionless relay that ultimately executes the default-branch workflow. Pin third-party actions and containers to immutable commit SHAs or digests. Document organization-level secret boundaries, and add regression tests that enforce trusted checkout, action pinning, environment protection, and approval invalidation when release metadata changes or approval is revoked.