ci: harden GitHub Actions workflows with zizmor recommendations

[indaco]

Description

• Add permissions: {} at workflow level and minimal job-level permissions across all workflows
• Add persist-credentials: false to all checkout steps
• Replace softprops/action-gh-release with gh release CLI in release workflow
• Fix template injection by passing github.event.release.tag_name via env var

Related Issue

• None

Notes for Reviewers

Findings from zizmor static analysis on all workflow files (ci.yml, coverage.yml, release.yml, security.yml).

Remaining unpinned-uses findings are intentionally kept - tags preferred over SHA pinning.