ci: harden GitHub Actions security

[kratsg]

Summary

CI security hardening, no behavior changes to the runner image build/publish logic.

• Pin all GitHub Actions in docker.yml and update-versions.yml to commit SHAs (via actions-up), with a version comment on each
• docker.yml:
  • Add explanatory comments to job permissions (packages: write, id-token: write, attestations: write)
  • Set persist-credentials: false on the checkout step (job doesn't need git push)
  • Fix a template-injection finding on the "Image digest" step by piping the expansion through an env: var
  • Split the build provenance attestation into its own attest job (needs: docker) so id-token/attestations permissions aren't granted to the build-and-push job; the digest is passed via job outputs
• update-versions.yml:
  • Add permissions: {} at the workflow level and scope the job to contents: write / pull-requests: write (needed for its git push + gh pr create)
  • Add a concurrency group and a job name
  • Set persist-credentials: true explicitly on checkout, with a comment, since this job pushes a branch and opens a PR with the default token
  • Remove the redundant COMPONENTS='${{ env.COMPONENTS }}' re-assignments (three template-injection findings) — COMPONENTS is already a workflow-level env: var and is already exposed to run: steps as $COMPONENTS
• Add .github/dependabot.yml: monthly grouped github-actions updates with a 7-day cooldown
• .pre-commit-config.yaml:
  • Add the zizmor pre-commit hook (pedantic persona, scoped to .github)
  • Set autoupdate_schedule: monthly under the existing ci: block
  • Freeze existing hooks (blacken-docs, pre-commit-hooks, pygrep-hooks, prettier, ruff-pre-commit, shellcheck-py, check-jsonschema) to SHAs via prek auto-update --freeze --cooldown-days 7

Major version changes

None. All actions and pre-commit hooks landed on the same major version (some minor/patch bumps: prettier v3.6.2 → v3.9.6, ruff-pre-commit v0.14.4 → v0.16.1, check-jsonschema 0.34.1 → 0.37.4, various GitHub Actions minor/major-tag-following bumps like actions/checkout v5 → v7.0.1, docker/build-push-action v6 → v7.3.0). pre-commit run --all-files passes clean after these updates, so nothing is held back.

Held-back items

None. actions/attest-build-provenance had a release inside the 7-day cooldown window, so actions-up skipped it; it was pinned by hand to the SHA of the v3 tag it was already using (no version bump) to avoid leaving an unpinned ref.

zizmor ignores

None added. All pedantic-persona findings (artipacked, template-injection, undocumented-permissions, excessive-permissions, anonymous-definition, concurrency-limits) were fixed rather than ignored; uvx zizmor --persona=pedantic .github reports no findings.

Verification

• uvx zizmor --persona=pedantic .github → no findings
• uvx prek run --all-files → all hooks pass (including check-github-workflows, check-dependabot, and the new zizmor hook)
• No workflow uses: ref is a tag or branch; all are SHAs with a version comment