chore: harden GitHub Actions controls

[nikuscs]

Summary

• skip PR-triggered CI jobs when the pull request comes from a fork
• avoid persisting checkout credentials in CI jobs
• reduce release workflow default permissions to no scopes
• grant write token only to release write jobs and require the protected production environment for tag, release, and cleanup jobs

Verification

• Parsed workflow YAML locally
• Ran git diff --check

[nikuscs]

Added a follow-up commit on this branch with CODEOWNERS coverage for workflows, Cargo manifests/lockfile, Rust config, migrations, source, and sample config.