chore: harden GitHub workflows

[Regal753]

Purpose

• pin every CI, Pages, and Cloudflare Action to an immutable commit SHA
• add high-severity dependency review and release-note categories
• add a post-deploy and weekly Pages smoke/internal-link check
• bind the manual Contact Worker deployment to the main-only cloudflare-production environment
• avoid all files changed by the existing MachoWalker privacy PR Add MachoWalker app privacy page #23
• live-check the current published site successfully before opening this PR

Validation

• actionlint v1.7.12: pass
• git diff --check: pass
• gitleaks detect --no-git --redact: pass
• mutable Action-reference scan: 0 remaining

Safety

• Draft only; no merge, release, deployment, visibility, secret, or history change
• workspace tracking: G-398