Harden GitHub Actions workflows

[petyosi]

Summary

• Pin GitHub Actions workflow dependencies to full commit SHAs while preserving their existing major versions.
• Disable checkout credential persistence in CI and release workflows.
• Add release workflow concurrency, a dedicated release environment, and documentation for the actions: write permission.

Why

zizmor flagged unpinned action references, checkout credential persistence, missing release concurrency, undocumented permissions, and secret usage outside a dedicated environment. These updates harden the workflows without changing their intended CI or release behavior.

Validation

• zizmor .github/workflows
• zizmor --persona=auditor .github/workflows

[github-actions]

🎉 This PR is included in version 4.0.1 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀