chore: reuse GitHub hygiene workflows

[saagpatel]

Summary

• Reuse shared GitHub workflow patterns for hygiene checks.
• Refresh dependency metadata for the Vite security update.
• Override tmp to the patched 0.2.7 line for dev-tool audit coverage.
• Limit reusable workflow permissions without inheriting repository secrets.

Merge order

• Merge the sovereign reusable-workflow PR before this PR so the called workflows exist on the default branch.

Lockfile rationale

• pnpm-lock.yaml changed because package metadata now targets Vite 7.3.5 and tmp resolves to the patched 0.2.7 line.
• The lockfile was refreshed through pnpm and formatted by repo hooks.

Verification

• pnpm install --lockfile-only
• pnpm audit --audit-level high
• Workflow YAML parsed successfully.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 242e31476b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Avoid inheriting all secrets into shared workflow

On same-repository PR events, secrets: inherit implicitly exposes every available repository/org secret to the reusable workflow in saagpatel/sovereign@main, whereas the removed local jobs only used GITHUB_TOKEN. Because this hygiene check only needs token-scoped GitHub access, pass only the named token/permissions it needs or omit inherited secrets; the same exposure is introduced in lockfile-rationale.yml as well.

Useful? React with 👍 / 👎.