Pin all mutable @vN action tags in ci.yml to 40-character commit SHAs, matching the pattern already used in pr-checks.yml. Actions pinned: actions/checkout, pnpm/action-setup, actions/setup-node, actions/upload-artifact, actions/github-script, codecov/codecov-action. Add explicit `permissions: contents: read` to the quality, build-library, and test jobs, which previously had no permissions block. The benchmark job already had correct minimal explicit permissions. Publish provenance is not added: the release script is local-only and npm provenance requires an OIDC-backed GitHub Actions environment. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Vaclav Vancura <commit@vancura.dev>