Workflow jobs pin the runner image, bound their runtime, and start from least privilege

## Summary

Apply the three job-level settings the newest workflows already carry —
pinned runner image, `timeout-minutes`, restrictive top-level `permissions` —
to the four jobs that predate them.

## Motivation

`bats.yml`, `pre-commit.yml`, and `weekly.yml` are consistent: `ubuntu-24.04`,
an explicit timeout, and a top-level `permissions` block that jobs widen where
they need to. The older files never got the same pass, so the repo now reads
two ways depending on when a file landed.

Current census:

| Workflow | Job | Runner | `timeout-minutes` | Top-level `permissions` |
| --- | --- | --- | --- | --- |
| Astro | `build` | `ubuntu-latest` | — | yes |
| Bats | `run` | `ubuntu-24.04` | 10 | yes |
| Labels | `ideas` | `ubuntu-latest` | — | yes |
| Pages | `build` | `ubuntu-latest` | — | — |
| Pages | `publish` | `ubuntu-latest` | — | — |
| Pre-commit | `run` | `ubuntu-24.04` | 10 | yes |
| Weekly | `links` | `ubuntu-24.04` | 20 | yes |

What each gap costs:

- `ubuntu-latest` rolls to the next image on GitHub's schedule, so a build
breaks on their calendar rather than on a diff. The pinned files move when
Renovate offers the bump.
- No `timeout-minutes` leaves the 6-hour job default, so a hung step burns
hours before it fails.
- `pages.yml` is not leaking anything today: both jobs declare their own
`permissions`. The gap is the default — a job added later inherits the
repository's token scope instead of `contents: read`.

## Scope

- `ubuntu-latest` to `ubuntu-24.04` in `astro.yml` (`build`), `labels.yml`
(`ideas`), and both `pages.yml` jobs
- `timeout-minutes` on those same four jobs
- Top-level `permissions: contents: read` in `pages.yml`; both jobs keep their
own blocks unchanged

## Acceptance criteria

- [ ] No workflow uses `ubuntu-latest`
- [ ] Every job sets `timeout-minutes`
- [ ] Every workflow file sets a top-level `permissions` block
- [ ] `pre-commit run --all-files` passes

## Additional context

Blocked by #390: PR #388 rewrites `astro.yml` into `ci.yml` and edits both
`pages.yml` and `labels.yml`, so doing this first guarantees a conflict on
every file in scope. Kept out of that PR to hold it to its own issue.

`alunduil-chezmoi` is uniform on all three settings across its workflows.