ci: least-privilege token + SHA-pin the third-party setup-uv action

Borrowed from awesome-web-security's CI hardening posture:

- Add `permissions: contents: read` at the workflow level. The job only
  checks out code and runs tests — it never pushes, tags, comments on PRs,
  or opens issues. Specifying `permissions:` also drops every unlisted scope
  to `none`, so a compromised dependency/action in the test run can't use the
  GITHUB_TOKEN to write to the repo.
- Pin the third-party `astral-sh/setup-uv` to its commit SHA (v5.4.2) instead
  of the moving `@v5` tag, so a repointed tag can't inject code that runs with
  this workflow's token. GitHub-owned `actions/checkout` stays on `@v4`
  (matching awesome-web-security: SHA-pin third-party, tag GitHub-first-party).

Cache still works (the Actions cache service uses a separate scoped token, not
`contents`); the rlm-kit git dep is public so read-only checkout suffices.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: qazbnm456

.github/workflows/ci.yml

@@ -7,6 +7,12 @@ on:
     branches: [main]
   pull_request:
 
+# Least privilege: this workflow only checks out code and runs tests — it never
+# writes to the repo, comments on PRs, or opens issues. Pin the token to read so a
+# compromised dependency/action in the test run can't push, tag, or open a PR.
+permissions:
+  contents: read
+
 concurrency:
   group: ci-${{ github.ref }}
   cancel-in-progress: true
@@ -22,7 +28,11 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        # Third-party action pinned to a commit SHA for supply-chain integrity
+        # (a moving major tag could be repointed at malicious code that runs with
+        # this workflow's token). GitHub-owned actions (checkout) stay on a major
+        # tag. Bump the SHA and the trailing version comment together.
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
         with:
           enable-cache: true
 

CHANGELOG.md

@@ -60,7 +60,9 @@ set of hard-won conventions instead of re-deriving them worse.
   the host-side authority), `.claude/rules/handoff.md`.
 - **CI** (`.github/workflows/ci.yml`) — runs the pipeline + wiring suite (core + studio console) on
   Python 3.11/3.12 via `uv sync --all-extras --all-packages`, plus the studio frontend's node core-tests;
-  no live model, network, or Deno needed. `cve-reverser --version` now prints the package version.
+  no live model, network, or Deno needed. `cve-reverser --version` now prints the package version. Runs
+  least-privilege (`permissions: contents: read` — it only checks out and tests, never writes) with the
+  third-party `astral-sh/setup-uv` action SHA-pinned (GitHub-owned `actions/checkout` stays on a major tag).
 - **Studio frontend split** — the ~1.5k-line `app.js` DOM IIFE sheds its trajectory-replay drawer into
   `trajectory.js` (a factory handed the shared helpers + getters for the live run-id / busy state it only
   READS; the pure replay math already lived in `replay-core.js`), with a node contract test asserting the