CI(security): harden GitHub Actions workflows

[AlexV525]

Summary

Hardens GitHub Actions workflows to resolve zizmor CI/CD security findings reported in fluttercandies/security-scanner#11.

Changes

All changes are limited to .github/workflows/.

artipacked (Low) — persist-credentials: false

Added persist-credentials: false to every actions/checkout step across all workflows. None of these workflows push back via git using the checkout's own token, so this is always safe.

• codeql.yml — 1 checkout step
• publish.yml — 1 checkout step
• publishable.yml — 1 checkout step
• runnable.yml — 3 checkout steps

excessive-permissions (Medium) — workflow-level permissions:

codeql.yml: hoisted the existing job-level permissions: block (under the single analyze job) up to workflow level. The block (security-events: write, packages: read, actions: read, contents: read) is unchanged in content — only its placement moved from job-level to workflow-level.

The other three workflows (publish.yml, publishable.yml, runnable.yml) already have a restrictive workflow-level permissions: {} and needed no change.

Not addressed

• stale-action-refs (Low): All action references are already pinned to commit SHAs (the secure pattern). The Low finding only notes that some SHAs do not resolve to a release tag — this is informational, not a security defect, and is intentionally left as-is.

Resolves zizmor findings in fluttercandies/security-scanner#11.