CI: Add release, contract artifact, and Actions hardening checks

[suleimanjem-hash]

Summary

This PR adds isolated CI/CD hardening controls for SplitNaira as part of Backlog Wave 6.

The changes introduce:

• A documented flaky-test quarantine policy and flaky-test label validation flow.
• A contract WebAssembly artifact size check to detect unexpected build-size growth.
• Release branch naming validation using the release/v<major>.<minor>.<patch> convention.
• A scheduled GitHub Actions permissions audit with local audit tests and documented security guidance.

All changes are isolated under .github/ and do not modify application, frontend, backend, or contract runtime behavior.

Changes

Flaky-test quarantine

• Added a documented quarantine policy.
• Defined ownership and tracking requirements.
• Added CI validation for the flaky-test label flow.
• Prevented the quarantine label from silently suppressing CI failures.

Contract artifact size

• Added a CI check for generated .wasm contract artifacts.
• Added a documented artifact-size policy.
• Reports artifact size and configured limits clearly.
• Fails CI when an artifact exceeds the configured threshold.

Release branch naming

• Defined the release branch convention:
  release/v<major>.<minor>.<patch>
• Added CI validation for release/* branches.
• Documented ownership and operational impact.
• Leaves normal feature, fix, and development branches unaffected.

GitHub Actions permissions

• Added a scheduled permissions audit.
• Inspects workflow permission declarations.
• Reports missing explicit permissions and write-level permissions for maintainer review.
• Added local tests for the audit logic.
• Keeps the audit itself restricted to read-only repository access.

Validation

• Ran the relevant local CI/audit checks.
• Ran git diff --check.
• Confirmed the changes remain isolated to .github/.

Related Issues

Closes #1144
Closes #1145
Closes #1146
Closes #1147

[drips-wave]

@suleimanjem-hash Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits