Harden CI credentials and pin the test toolchain

[Jerrycyborg]

Summary

Hardens the GitHub Actions trust boundary without changing trading behavior.

• declares workflow-wide contents: read permissions
• disables checkout credential persistence in all three jobs
• pins uv 0.12.4 and Python 3.11
• preserves the prior cache-pruning behavior explicitly
• corrects the workflow's network-access documentation
• adds a regression test for each CI security invariant

Verification

• exact head: 64a60194d570ca8cafed49f21f17867837265d2c
• push CI passed
• lint, full tests, and Compose paper-trading checks passed
• branch is 2 commits ahead and 0 behind main

Dependency PRs

Dependabot PRs #4 and #5 remain unmerged. After this PR lands, they should be rebased and rechecked while retaining these explicit inputs and credential controls.