CI hardening follow-ups surfaced by the per-PR CI restore (#1956) #1958

Review bots raised these on relay#1956, which restores per-PR CI by reverting the trunk-gating commits. Every workflow file #1956 touches is byte-identical to its state before the merge train (649a3c910^), so none of them is new. The trunk gating had only hidden them on feature PRs for a day. They're tracked here so the revert stays a pure revert.

Security (do first)

• P1 e2e-tests.yml: same-repo PR runs get ANTHROPIC_API_KEY, and PR code runs during install, build and test. Keep PR runs secretless, since the daemon-only path already handles a missing key. (cubic)
• persist-credentials: false on checkouts in jobs that execute dependency code: rust-ci.yml (rust-test, rust-cross-compile, rust-clippy, sdk-check), and audit the other workflows. (cubic, CodeRabbit)
• relayflow-pr-proof-broker.yml: scripts/pr-proof/resolve-broker-artifacts.mjs trusts any pull_request_target run of this workflow. Tighten the resolver's trust predicate. (cubic)
• security.yml: CodeQL on fork PRs can't get security-events: write, so the SARIF upload fails. Add a same-repo check to that job. (cubic)

CI hygiene

• codegen-models.yml: a feature-branch push auto-commits regenerated files with [skip ci], leaving the new head unvalidated. (cubic)
• rust-fmt-fix.yml: the formatter pushes to same-repo PRs targeting any base. Scope it to main? (cubic)
• Duplicate push and pull_request runs: test-install.yml, test-build.yml, fleet-e2e.yml (feat/fleet-**). (cubic)

🤖 Generated with Claude Code