fix(ci): harden GitHub Actions workflows (#15)

[hf-security-analysis]

Automated hardening of the workflow files flagged on #15.

Warning

This changes when the workflow runs and what it can reach. Both triggers and permissions were rewritten in .github/workflows/pwc-cli-release.yml. Read the diff before merging — either one can change what the workflow is able to do.

Targets dependabot/github_actions/actions-fec89da322. Files changed:

• .github/workflows/pwc-cli-release.yml
• .github/workflows/pwc-mcp-release.yml

Fixed by this PR:

• HIGH excessive-permissions (zizmor) — .github/workflows/pwc-cli-release.yml:9
• HIGH excessive-permissions (zizmor) — .github/workflows/pwc-cli-release.yml:10
• HIGH excessive-permissions (zizmor) — .github/workflows/pwc-cli-release.yml:11
• HIGH unpinned-action (pinact) — .github/workflows/pwc-cli-release.yml:27
• HIGH unpinned-action (pinact) — .github/workflows/pwc-cli-release.yml:28
• HIGH unpinned-action (pinact) — .github/workflows/pwc-cli-release.yml:42
• HIGH unpinned-action (pinact) — .github/workflows/pwc-cli-release.yml:45
• HIGH unpinned-action (pinact) — .github/workflows/pwc-cli-release.yml:54
• HIGH unpinned-action (pinact) — .github/workflows/pwc-cli-release.yml:58
• HIGH unpinned-action (pinact) — .github/workflows/pwc-mcp-release.yml:20
• HIGH unpinned-action (pinact) — .github/workflows/pwc-mcp-release.yml:21
• HIGH unpinned-action (pinact) — .github/workflows/pwc-mcp-release.yml:63
• HIGH unpinned-action (pinact) — .github/workflows/pwc-mcp-release.yml:64

Permissions

.github/workflows/pwc-cli-release.yml

job	granted	why
build	attestations: write, contents: read, id-token: write	actions/checkout needs contents: read and actions/attest-build-provenance needs attestations: write plus id-token: write; upload-artifact within the same run needs nothing, and the local build script (check_contract.py / pyinstaller) makes no API calls I could see.
release	contents: write	softprops/action-gh-release creates/updates the GitHub release and uploads assets, requiring contents: write; download-artifact pulls artifacts from the same run so it needs no scope (if the runner's artifact API version requires it, artifact-metadata: read would be the one to add).

Anything not listed above keeps the permissions it had. To measure a job this could not read, add GitHubSecurityLab/actions-permissions/monitor to it and run the workflow — it reports the minimum the run actually used.

Pinning changes come from pinact and are mechanical. Any other change was generated by Claude — read it before merging.