Always enforce trusted-code boundaries for privileged workflows

For GitHub Actions that use secrets, write permissions, approvals, or release state, ensure only trusted default-branch code executes. Pin third-party actions to immutable commit SHAs, place secret-bearing jobs behind the protected production environment, and never expose repository secrets to workflows dispatchable from arbitrary refs. Use an unprivileged relay for manual dispatch, require successful default-branch execution before privileged processing, and revalidate approval state immediately before transitions such as ci-ready. Add regression tests for these workflow invariants, then run the full test suite and lint checks after changes.