feat(harden-runner): harden GitHub Actions jobs

[Copilot]

Adds the shared DevSecNinja/.github Harden-Runner composite action to this repository’s GitHub Actions workflows. The rollout uses audit mode via the wrapper defaults so jobs can observe runtime egress before any blocking policy is introduced.

• Workflow hardening
  • Adds Harden-Runner to eligible Linux jobs across CI, docs, release, devcontainer, Bats, sync, and automation workflows.
  • Places Harden-Runner before checkout where applicable so it observes checkout and all subsequent job steps.
  • Pins the central composite action by full SHA and includes Renovate metadata.

- name: Harden runner
  # renovate: datasource=github-tags depName=DevSecNinja/.github
  uses: DevSecNinja/.github/actions/harden-runner@bf22fcfcb4ef94a359eed55cea4b5ce7f5b98167 # main

• Regression coverage
  • Adds Bats coverage to enforce:
    • central wrapper usage, not direct step-security/harden-runner calls
    • full-SHA pinning
    • Renovate metadata
    • expected workflow coverage
    • Harden-Runner ordering before checkout in hardened jobs

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• dl.google.com
  • Triggering command: /usr/lib/apt/methods/https /usr/lib/apt/methods/https 501 6 1 sh 0HyL/test -T p/bin/bash -x -T /home/REDACTED/work/dotfiles/dotfi--dummy-flag bash s-ex�� --dummy-flag -T n-failure -x -T les/tests/bash/t/tmp/bats-run-PY0HyL/test gic-3a_zsh_config_contains_VS_Co/tmp/tmp.tQ5XUhm3Ie/log.sh.sha256 (dns block)
• mise.run
  • Triggering command: /usr/bin/curl curl -fsSL REDACTED (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)