security: harden publish workflow against Mini Shai-Hulud (pin + egress)

[nmccready]

Summary

Part of the Mini Shai-Hulud supply chain hardening campaign — closing OIDC hijack vectors in GitHub Actions publish pipelines across the brickhouse-tech org and related repos.

Changes

• Pin actions/checkout to SHA 11bd71901bbe5b1630ceea73d27597364c9af683 (v4.2.2)
• Pin actions/setup-node to SHA 48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e (v6.4.0)
• Add step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 (v2.19.1) as first step with egress block allowlist
• Add --ignore-scripts to npm ci to block postinstall/preinstall script execution
• Add contents: read to job permissions (was missing — only id-token: write was set)

Threat model

TeamPCP's Mini Shai-Hulud worm uses OIDC identity injection to hijack publish pipelines mid-workflow. Unpinned action refs allow SHA-swapping attacks; permissive egress allows exfiltration; missing --ignore-scripts allows dependency install-time code execution.

Precedent

Same pattern already merged in:

• chore(security): harden shared publish workflow vs Mini Shai-Hulud .github#7
• chore(security): harden publish workflow vs Mini Shai-Hulud node-xml2js#6
• chore(security): pin reusable publish workflow SHA (mini shai-hulud) angular.js#10
• chore(security): pin reusable publish workflow SHA (mini shai-hulud) json-schema#4

Test plan

• Workflow YAML is valid (no syntax errors)
• SHA pins match the tagged releases (v4.2.2, v6.4.0, harden-runner v2.19.1)
• npm ci --ignore-scripts does not break the publish for this package
• harden-runner egress allowlist covers all required endpoints for npm publish + OIDC