ci: pin workflow action refs to commit SHA and tighten permissions

[kitsuyui]

Summary

• Pin all GitHub Actions references in test.yml and main.yml to commit SHA
• Reduce permissions.contents from write to read in test.yml

test.yml referenced actions/checkout@v6, oven-sh/setup-bun@v2, actions/setup-node@v6, and kitsuyui/gh-build-size@v0.1.2 using only version tags. main.yml referenced actions/checkout@v6 similarly. Tags can be force-pushed by the repository owner at any time, creating a supply-chain risk.

octocov.yml already pinned all its actions to SHA in previous PRs (#823, #824); this change applies the same pattern to the remaining workflows.

The contents: write permission in test.yml was excess — the workflow only reads source, runs lint/test/build, and measures build size; none of these require write access to repo contents.

Validation

• bun run lint (biome check) — no issues
• bun run test — 47/47 tests pass
• madge --circular --extensions ts src/ — no circular dependencies

Notes

SHAs match those already used in octocov.yml:

• actions/checkout → de0fac2e4500dabe0009e67214ff5f5447ce83dd (v6)
• oven-sh/setup-bun → 0c5077e51419868618aeaa5fe8019c62421857d6 (v2)
• actions/setup-node → 48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e (v6)
• kitsuyui/gh-build-size → 97ad8d5f4fff8ba676a5c614822adacab32780e3 (v0.1.2)

[github-actions]

🎉 Happy commit!

• dogfooding: PR ci: pin workflow action refs to commit SHA and tighten permissions #839 always celebrates.
• dogfooding: ca586869ee0f7ef4b38e6f4577fc49f60d9d48b8 always celebrates.

[github-actions]

Code Metrics Report

	main (5e1e87b)	#839 (21d52c4)	+/-
Coverage	99.2%	99.2%	0.0%
Code to Test Ratio	1:0.5	1:0.5	0.0
Test Execution Time	2s	1s	-1s

Details

  |                     | main (5e1e87b) | #839 (21d52c4) | +/-  |
  |---------------------|----------------|----------------|------|
  | Coverage            |          99.2% |          99.2% | 0.0% |
  |   Files             |              5 |              5 |    0 |
  |   Lines             |            131 |            131 |    0 |
  |   Covered           |            130 |            130 |    0 |
  | Code to Test Ratio  |          1:0.5 |          1:0.5 |  0.0 |
  |   Code              |           1630 |           1630 |    0 |
  |   Test              |            912 |            912 |    0 |
+ | Test Execution Time |             2s |             1s |  -1s |

---

Reported by octocov