[xavierchanth]

Changes

• Keep workflow defaults, builds, Nix dependency fetching, and lock verification at contents: read.
• Isolate contents: write and pull-requests: write to the final lockfile PR job; publishing retains only contents: write.
• Disable persisted checkout credentials and authenticate Git only in the final push step.
• Pass the verified lockfile as an artifact and check out its exact source SHA in the writer job.
• Add weekly grouped Dependabot updates for GitHub Actions.
• Add read-only PR workflow linting and a full-commit-SHA check for action references. Every current external action is SHA-pinned.

Verification

• actionlint passes for both workflows.
• Dependabot YAML parses.
• The immutable-action-reference check passes locally.
• The split release jobs have not been exercised by a new release; v1.0.0 assets are unchanged.

No repository security settings, Apple signing configuration, auto-approval, or auto-merge are enabled by this PR.