Bug: CI release workflows use mutable actions with broad publish-capable permissions

[Abdulmumin1]

Release and drift workflows use mutable action refs and broad/default GitHub token permissions. Affected areas: .github/workflows/release.yml and .github/workflows/openapi-drift.yml. Impact: a compromised mutable action tag in a privileged workflow could use repository write permissions or OIDC publishing permissions in the package release path. Expected: CI jobs follow least privilege and pin third-party/GitHub actions to immutable SHAs. Fix: pin actions to full commit SHAs, split build and publish so id-token: write exists only on the publish job, set minimal permissions such as contents: read where possible, disable checkout credential persistence before untrusted install/build steps, and keep release environment approvals on publish.

[webbrain-one]

👋 I've opened PR #234 to fix this.

This PR pins all workflows to immutable action SHAs, tightens permissions to least privilege (splitting build and publish to restrict id-token: write), disables credential persistence on checkout, and keeps release environment approvals intact.

Thanks for flagging this! 🚀