Fix Skylos remediation findings

[vndv]

Summary

• harden CI and release workflows with least-privilege permissions, pinned actions, disabled checkout credential persistence, ignored install lifecycle scripts, release timeouts, and separated provenance publishing
• add Skylos gate and pre-commit policy config
• split JSON-RPC session handling into smaller helpers
• exclude generated npm lockfile integrity hashes from Skylos secret scanning

Verification

• npm run ci
• npm test
• npm pack --dry-run --json
• skylos . -a --format json