chore(ci): fix ci serurity and add build wheels for test pypi

.github/workflows/build_test_wheel.yml

@@ -0,0 +1,55 @@
+name: Build Test PyPi Wheels
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build_wheels:
+    name: Build wheels on self-hosted manylinux_2_28
+    runs-on: linux_x64
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - name: Set up Python (for cibuildwheel controller)
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install cibuildwheel
+        run: |
+          pip install --upgrade pip
+          pip install cibuildwheel==2.17.0
+      - name: Build wheels using cibuildwheel
+        run: |
+          python -m cibuildwheel --output-dir wheelhouse
+          # Save list of built wheels for publishing
+          ls wheelhouse/*.whl | tee $GITHUB_STEP_SUMMARY
+          echo "wheels=$(ls wheelhouse/*.whl | tr '\n' ' ')" >> $GITHUB_ENV
+      - name: Publish to TestPyPI
+        if: success() && github.event_name == 'workflow_dispatch'
+        env:
+          TWINE_USERNAME: __token__
+          TWINE_PASSWORD: ${{ secrets.TEST_PYPI_API_TOKEN }}
+          TWINE_REPOSITORY_URL: https://test.pypi.org/legacy/
+        run: |
+          pip install twine
+          twine upload --skip-existing --verbose wheelhouse/*.whl
+      - name: (Optional) Install and test from TestPyPI
+        if: success() && github.event_name == 'workflow_dispatch'
+        run: |
+          # Create a clean venv
+          python -m venv test_env
+          source test_env/bin/activate
+          pip install --upgrade pip
+          # Install from TestPyPI (must allow pre-releases if version has dev/alpha)
+          pip install --index-url https://test.pypi.org/simple/ zvec
+          # Run a simple smoke test
+          python -c "import zvec; print('Import OK:', zvec.__version__)"
+        shell: bash

.github/workflows/build_wheel.yml

@@ -3,6 +3,9 @@ name: Build Wheels
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build_wheels:
     name: Build wheels on self-hosted manylinux_2_28

.github/workflows/linux_x64_docker_ci.yml

@@ -7,6 +7,9 @@ on:
     branches: [ "main" ]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: linux_x64

.github/workflows/mac_arm64_ci.yml

@@ -7,6 +7,9 @@ on:
     branches: [ "main" ]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: mac_m1_arm

.github/workflows/nightly_coverage.yml

@@ -7,6 +7,9 @@ on:
 
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   coverage:
     runs-on: linux_x64