[Hermes] Harden CI workflow security, add project.urls, add ruff dep, add .gitattributes

[Coding-Dev-Tools]

Summary

Harden CI workflow security across all 4 workflows, add complete project metadata URLs, add ruff as a dev dependency, and add .gitattributes for consistent line endings.

Why this change

• Security: actions/checkout persists the GitHub token in .git/config after checkout by default. Any later step that runs arbitrary code can exfiltrate this token. Adding persist-credentials: false to all read-only checkout steps prevents this.
• Least privilege: CI workflow had no permissions block, inheriting the repo's default token permissions. Adding permissions: contents: read follows the principle of least privilege.
• Packaging: The inline urls = {...} was missing Documentation, Issues, and Changelog links. Converted to standard [project.urls] table with all 5 standard URLs.
• Dev experience: Ruff was installed separately in CI (pip install ruff) instead of being declared as a dev dependency. Now ruff>=0.4.0 is in [project.optional-dependencies.dev] and the lint step uses pip install -e ".[dev]".
• Line endings: No .gitattributes existed, risking CRLF/LF corruption from cross-platform edits.

What changed

• .github/workflows/ci.yml: Added permissions: contents: read, persist-credentials: false to 2 checkout steps, replaced pip install ruff with pip install -e ".[dev]"
• .github/workflows/publish.yml: Added persist-credentials: false to checkout step
• .github/workflows/pages.yml: Added persist-credentials: false to checkout step
• .github/workflows/npm-publish.yml: Added persist-credentials: false to checkout step
• pyproject.toml: Converted inline urls to [project.urls] table with Homepage, Documentation, Repository, Issues, Changelog; added ruff>=0.4.0 to dev deps
• .gitattributes: New file with * text=auto eol=lf and Windows script CRLF overrides

Validation performed

• ruff check src/ tests/ — All checks passed
• python -m pytest tests/ -q — 84 passed
• pyproject.toml validated with tomllib.load() — valid TOML, correct structure

Risks/rollback

• Low risk: persist-credentials: false only affects token persistence; none of these workflows do git push
• The npm-publish workflow uses NODE_AUTH_TOKEN, not git credentials, so hardening is safe
• Adding ruff to dev deps is additive; existing installs unaffected

Follow-ups

• Monitor CI run on this PR to verify lint step works with pip install -e ".[dev]" instead of pip install ruff