chore: harden supply chain — pin actions, persist-credentials, deny.toml

[decofe]

• Pin all GH Actions to SHAs via pinact (17 refs across 4 workflows + 2 composite actions)
• Add persist-credentials: false to every actions/checkout
• Pin npm install -g @anthropic-ai/claude-code@2.1.105 in changelog workflow
• Pin pip install build==1.2.2.post1 twine==6.2.0 in composite action
• Scope binary.yml permissions per-job (build=contents: read, upload=contents: write)
• Add save-if to rust-cache in release workflow to prevent cache poisoning
• Add permissions: contents: read to ci.yml
• Add deny.toml with advisories + sources policy
• Add dependabot.yml for cargo + github-actions with 7-day cooldown

Prompted by: georgen

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​anyhow@​1.0.100 ⏵ 1.0.102	+1
	cargo/​chrono@​0.4.43 ⏵ 0.4.44
	cargo/​clap@​4.5.54 ⏵ 4.6.0
	cargo/​inquire@​0.9.2 ⏵ 0.9.4
	cargo/​rand@​0.9.2 ⏵ 0.9.4		+1
	cargo/​regex@​1.12.2 ⏵ 1.12.3			-1
	cargo/​semver@​1.0.27 ⏵ 1.0.28
	cargo/​tempfile@​3.24.0 ⏵ 3.27.0	-1

View full report

[github-actions]

⚠️ Changelog not found.

A changelog entry is required before merging. We've generated a suggested changelog based on your changes:

Preview

---
changelogs: patch
---

Hardened CI supply chain security by pinning all GitHub Actions to full commit SHAs, adding `persist-credentials: false` to checkout steps, scoping workflow permissions to least privilege, adding a `cargo deny` check via reusable workflow, and enabling Dependabot for automated dependency updates. Also bumped multiple Rust dependencies to their latest versions.

Add changelog to commit this to your branch.