ci: harden workflow reproducibility and evidence gates

[AlexStocks]

Summary

This maintenance PR brings the following CI hardening patterns from powercontext-go to the Python repository:

• Pin every third-party GitHub Action in the tracked workflows and composite environment action to an immutable commit SHA, while retaining the human-readable version comments.
• Add least-privilege read permissions, concurrency control, bounded job timeouts, and disable persisted checkout credentials on read-only checkouts where the workflow does not need them.
• Make the E2E replay-evidence secret scan fail closed: missing or empty evidence and scanner failures fail the acceptance job; raw evidence is uploaded only after a successful scan.
• Upload only a bounded diagnostic summary when evidence validation fails, and run the scanner without network access.

The existing Python workflow topology, SQLite/OceanBase acceptance matrix, release jobs, and product behavior are unchanged. Go-specific build and release gates are intentionally out of scope.

Verification

• actionlint on all tracked workflow files: passed
• YAML/action policy contract check: passed; 55 external action references are pinned to 40-character SHAs
• git diff --check: passed
• make contract-test: passed (48 tests)
• make harness-sync && make harness-check: passed (34 tests)
• make check: YAML, formatting, and Ruff checks passed; the existing baseline ty stage remains blocked by 7 unrelated diagnostics in src/powercontext/builtin/runtime/artifact_processing.py and tests/builtin/runtime/test_artifact_processing.py
• Docker Compose acceptance was not run locally because Docker is unavailable in the validation environment

No issue is referenced because this is a bounded CI maintenance change rather than an implementation of an existing issue.

[Copilot]

🔵 Needs a closer look

The broad CI and security hardening changes warrant final human review.

Pull request overview

This PR hardens CI reproducibility, permissions, timeouts, and E2E evidence validation without changing product behavior.

Changes:

• Pins external actions and scanner images to immutable SHAs.
• Adds concurrency, timeouts, least-privilege permissions, and credential protections.
• Enforces fail-closed evidence scanning with bounded diagnostics.

File summaries

File	Summary
.github/workflows/release.yml	Hardens release jobs and pins actions.
.github/workflows/release-verify.yml	Adds timeout and immutable action pins.
.github/workflows/native-service.yml	Adds CI safeguards across platforms.
.github/workflows/master.yml	Adds permissions, concurrency, timeouts, and pins.
.github/workflows/license-check.yml	Adds read permissions and pinned actions.
.github/workflows/e2e-harness.yml	Enforces secure evidence scanning and diagnostics.
.github/workflows/deploy-docs.yml	Hardens documentation deployment.
.github/workflows/build-docker.yml	Pins Docker tooling and hardens checkout.
.github/workflows/build-artifacts.yml	Pins build dependencies and hardens checkout.
.github/actions/setup-python-env/action.yml	Pins composite-action dependencies.

Review details

• Files reviewed: 10/10 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.