Pin dependencies by hash and restrict GitHub Actions workflow token permissions

## Summary
OpenSSF Scorecard flags two related supply-chain hardening gaps:
- **Pinned-Dependencies: 0/10** — dependencies (npm packages and/or GitHub Actions) are not pinned by hash
- **Token-Permissions: 0/10** — one or more workflows in `.github/workflows/` grant excessive `GITHUB_TOKEN` permissions (broader than needed, e.g. default `write-all` instead of least-privilege)

## Tasks
- [ ] Audit `.github/workflows/*.yml` and add an explicit `permissions:` block (least privilege) to every workflow/job that's missing one
- [ ] Pin third-party GitHub Actions to a full commit SHA instead of a floating tag (e.g. `actions/checkout@` not `@v4`)
- [ ] Evaluate pinning critical npm dependencies by hash/lockfile integrity where feasible
- [ ] Re-run Scorecard and confirm both checks move off 0

## Why this matters
Unpinned actions/dependencies and overly-broad workflow tokens are classic supply-chain attack surfaces (tag mutation, compromised upstream releases). Both are cheap, mechanical fixes with an outsized Scorecard impact.

## References
- Scorecard checks: `Pinned-Dependencies` (score 0), `Token-Permissions` (score 0)
- `.github/workflows/`

Start by auditing the workflows under `.github/workflows/*.yml`, checking each workflow or job for missing permissions and floating third-party action references. Review the npm dependency metadata for feasible integrity pinning, then re-run the OpenSSF Scorecard checks; done means both `Pinned-Dependencies` and `Token-Permissions` have moved off 0.

由索引模型根据 Issue 内容生成。