ci: fix provenance tests (fetch-depth 0) and harden the workflow

[Nazim22]

Follow-up to #5. The first CI run on main went red: 7 provenance/replay tests failed with

fatal: ambiguous argument '8488cb333157208e9781f8d3c32ea0dda587a368^{tree}': unknown revision

Root cause. actions/checkout defaults to a shallow, single-branch clone. The replay and provenance suites verify the sealed exam runtime by reading its exact Git objects at commit 8488cb3 (see docs/EXAM.md), and that commit is only reachable through the full ref graph.

Reproduced locally rather than inferred:

$ git clone --depth 1 --single-branch --branch main <repo> shallow
$ cd shallow && git rev-list --count HEAD
1
$ git cat-file -e 8488cb3^{commit}; echo $?
1        # unreachable

Fix: fetch-depth: 0, with a comment explaining why it is load-bearing so it does not get "optimised" back to a shallow clone later.

Hardening included while here:

• permissions: contents: read — least privilege
• Node matrix 18/20/22, so engines.node >= 18 in package.json is proven rather than asserted (Node 18 was already fine: all 7 failures shared the single Git cause, 223/230 passed)
• runs npm run bench alongside npm test

Note this is not only a CI concern: it documents a real property of the repo. The sealed commit must stay reachable, so the dae/* branches that anchor it must never be deleted.

🤖 Generated with Claude Code