Harden CI: SHA-pin all actions, add persist-credentials: false

- SHA-pin actions/checkout, actions/setup-node, pnpm/action-setup,
  and slackapi/slack-github-action to immutable commit SHAs
- Add persist-credentials: false to all checkout steps to limit
  token exposure in a public repo
- Add top-level permissions: contents: read to enforce least
  privilege