fix(ci): harden workflow token scope and download integrity (#39)

Security audit of .github/workflows found a script-injection vector in the
release workflow, over-broad token grants on non-publishing jobs, and
downloaded tooling/manifests executed without integrity checks.

- release: pass the tag/dispatch input through env instead of interpolating
  it into the validation script; default workflow permissions to contents:read
- build-main/build-gateway: grant write scopes only to the build job
- _build-image/codeql: stop persisting checkout credentials
- ci/release: verify actionlint, hadolint and git-cliff against pinned SHA-256s
- ci-manifests/e2e: verify upstream CRD manifests against versions.env pins
- e2e: redact token material before uploading cluster diagnostics
- docs: add workflow-security.md with controls, audit record and residual
  repository-setting recommendations

Co-authored-by: SREDevOpsAgents <agents@sredevops.org>

versions.env

@@ -16,8 +16,12 @@ PNPM_VERSION=11.28.5
 RELEASE_REVISION=
 
 # Control-plane versions used by the examples and their manifests.
+# The matching SHA-256s pin the release manifests that CI downloads and
+# applies; update both the version and the digest when bumping either pin.
 AGENT_SANDBOX_VERSION=v1.0.9
+AGENT_SANDBOX_MANIFEST_SHA256=4bf9ee5558e9a663f91cfa5963e96f2591bfaa1dcf79f03bfab65bc5d65cc699
 GATEWAY_API_VERSION=v1.2.1
+GATEWAY_API_MANIFEST_SHA256=97598bf6ab3b33b9b5c5432bdd24de091e4e9c3aa0575ebb0710a2a19cd64d64
 OAUTH2_PROXY_IMAGE=quay.io/oauth2-proxy/oauth2-proxy:v7.15.5
 
 # Registry layout: the main image is the repository itself, and every example