Harden reusable workflow contracts

[jmcte]

Summary

• route rg-security and rg-release exclusively to GitHub-hosted runners
• make hosted execution the safe rg-ci default while retaining an explicit trusted shell-safe-public lane with shell-safe Node installation
• pin every external action in the reusable workflows to a full commit SHA
• add a real caller workflow that invokes all three contracts; release smoke builds without publishing, signing, or attesting
• document the exact immutable v0.2.2 consumer reference and required permissions

Governing Issue

Refs #117

Issue #117 remains open until this PR and #170 are merged, the verified v0.2.2 GitHub release/tag is published from main, and the caller smoke is rerun against that public ref. The workflow implementation itself is merge-ready; tagging unreviewed feature-branch code would violate the release contract.

Validation

• CI=true bash scripts/ci/run-fast-checks.sh (49 files, 275 tests; lint and build passed)
• pnpm exec vitest run test/reusable-workflow-contract.test.ts test/security-workflow.test.ts test/workflow.test.ts (3 files, 21 tests passed)
• actionlint -ignore 'label .* is unknown' on all four reusable/caller workflows
• git diff --check

Contract Safety

• fork-safe hosted execution is the default
• Docker/Buildx/QEMU/release publication never targets shell-only runners
• release publication uses GITHUB_TOKEN plus OIDC; no long-lived registry secret is introduced
• smoke release mode cannot push, sign, or attest
• caller examples use a planned exact release tag, not a branch or moving compatibility tag

Merge Automation

• Ready for review
• Enable squash auto-merge after creation

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[athena-omt]

Reviewed the reusable workflow contract hardening. The contract now defaults untrusted CI callers to hosted runners, keeps privileged security/release workflows hosted, pins external actions to full SHAs, and adds smoke callers/tests that exercise the reusable entrypoints without publishing artifacts.

Validation run on the refreshed PR head:

• pnpm vitest run test/reusable-workflow-contract.test.ts test/security-workflow.test.ts
• pnpm lint