ci: harden workflow execution boundaries

[umutseve4]

Summary

• pin GitHub Actions to immutable revisions and set explicit read-only defaults
• add bounded timeouts and concurrency controls
• constrain the write-enabled formatter to exact main, make no-change handling index-aware, and push explicitly to main

Reproduced defects

The current workflows use mutable action tags, have no timeout/concurrency controls, and the manual formatter can be dispatched from an arbitrary ref with repository-wide write permission and an ambiguous git push.

Scope

Only .github/workflows/ci.yml and .github/workflows/format.yml are changed. Runtime code, tests, dependencies, and generated reports are untouched.

Acceptance

• PR-head ci quality job passes
• formatter remains manual-only and its write-capable job is gated to refs/heads/main
• independent QA confirms no blocking workflow regression

No merge is requested by this PR.