fix: harden CI publishing workflows against supply-chain attacks

[Copilot]

Summary

Hardens all three publishing workflows (C#/NuGet, Python/PyPI, JS/npm) against supply-chain attacks identified in a security audit of the CI/CD pipelines.

Changes

🔒 Pin all GitHub Actions to immutable commit SHAs (all 3 workflows)

All actions were referencing mutable version tags (e.g., @v3, @v4, @release/v1). If an upstream action repository is compromised, the attacker can move the tag to point at malicious code, which would execute with publishing credentials on the next workflow run.

Every action reference is now pinned to a specific commit SHA with the version tag in a trailing comment for readability:

# Before
- uses: actions/checkout@v4
# After
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

🔒 Split C# build/publish into separate jobs

Previously, the entire C# pipeline (build, test, pack, and publish) ran in a single job with id-token: write permission. This meant the OIDC token for NuGet publishing was available during build and test phases — a compromised NuGet dependency running code during dotnet restore/build/test could exfiltrate the token.

Now build and publish are separate jobs:

• build job: contents: read only — builds, tests, packs, and uploads artifacts
• publish job: id-token: write — downloads artifacts and pushes to NuGet

⬆️ Upgrade stale action versions

• C# workflow: actions/checkout v3→v4, actions/setup-dotnet v3→v4
• Python workflow: actions/setup-python v4→v5

🔒 Add --provenance to JS npm publish commands

• Added --provenance flag to npm publish commands to generate SLSA provenance attestation, allowing consumers to verify packages were built from this repository
• npm registry authentication continues to use the existing OIDC flow (id-token: write + registry-url in setup-node)

⚠️ Action required by maintainers

• Environment protection (optional but recommended): Consider adding a GitHub Environment with required reviewers on the publish jobs to prevent workflow_dispatch from bypassing review gates