ci: generate once, reuse artifacts, and isolate release permissions

[rwang23]

Summary

• generate and prepare the canonical theme artifacts once, then reuse the short-lived artifact in desktop and Gallery jobs
• pin every workflow action to a reviewed SHA, remove write permission from validation/matrix jobs, isolate signing credentials and contents: write in the tag-only release job, and add Dependabot plus actionlint/zizmor checks
• replace the non-empty Gallery screenshot probe with a Chromium CDP check for Registry card count, HTTP/runtime errors, keyboard dialog activation, and screenshot capture

Verification

• npm run check:full
• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12
• independent CI/security review, including trigger-path regression remediation
• GitHub Actions will execute the isolated Chromium path on this draft PR

Closes #12

[rwang23]

Superseded by #26, now merged into main at e2ed6e8. This branch head is already included in main; closing the draft avoids duplicate review and merge work.