build(ci): pin trusted supply-chain inputs

[mkhalid-s]

Addresses the workflow supply-chain recommendations in #87.

What changed

• pin checkout, pnpm setup, and Node setup actions to reviewed immutable commits
• pin the runner family, release Node runtime, and npm publishing client
• disable checkout credential persistence and dependency lifecycle scripts in the OIDC-enabled publish job
• split npm publishing and GitHub Release creation into least-privilege jobs
• make the checkout-free release job target the repository explicitly
• require the tag to match package.json and the tagged commit to be reachable from the default branch
• serialize releases per tag and bound CI, publish, and release job runtimes
• add separate Dependabot review loops for GitHub Actions and npm/pnpm dependencies

Validation

• action SHAs verified against upstream tag refs
• workflow YAML and shell expressions pass actionlint
• Dependabot YAML parses successfully
• clean install with dependency lifecycle scripts disabled passed typecheck, 920 tests, and build
• pnpm audit reports no known vulnerabilities
• hosted CI passed

A real npm publication was intentionally not performed because that would create an external release.