ci: fix zizmor audit findings

[MarshallOfSound]

Fixes zizmor audit findings surfaced in the latest scheduled audit run.

Auto-fixes applied:

• dependabot-cooldown: added 7-day default cooldown for github-actions updates
• artipacked: added persist-credentials: false to all actions/checkout steps
• cache-poisoning: added lookup-only: true to ESLint cache step
• template-injection: moved steps.version.outputs.version into env var in release.yml

Manual fixes:

• excessive-permissions: added top-level permissions: {} block to ci.yml, gh-pages.yml, and release.yml, plus minimal contents: read job-level grants where needed

Remaining (low-confidence) findings:

• 5 cache-poisoning warnings on actions/setup-node calls. These are flagged because the workflows are triggered by tag/branch pushes (publishing-style triggers). In ci.yml the cache is commented out, and in gh-pages.yml yarn caching is needed for the docs build. These have low audit confidence and are accepted as known.

cc @dsanders11