ci: backport the workflow trust surface hardening

[fyannk]

Backports 513690ff1 from #13 to the frozen 0.1 line, and supersedes #18.

Why this instead of #18

Dependabot opened #18 to move actions/attest@v4 → @v4.2.0 and
docker/login-action@v4 → @v4.5.2 in release.yml. That swaps one mutable
tag for a narrower mutable tag: it touches 2 of the 10 action references on this
branch and adds no real pinning guarantee, since a tag can still be moved.

release-0.1 is not a dormant branch — its release.yml holds contents: write, packages: write, and id-token: write, and uses them to push tags,
publish to ghcr.io, and sign attestations. main closed this gap in #13; the
release branch never received it.

What this does

The three workflows this branch shares with main were byte-identical to
main at the pre-hardening commit, so 513690ff1 cherry-picked with no
conflicts and the result matches main exactly.

• SHA pinning — all 36 uses: across ci.yml, docs.yml, and
  release.yml now reference a full commit SHA with the version in a trailing
  comment. This also brings the two actions from ci(deps): bump the release-0-1-actions-updates group with 2 updates #18 to the versions main
  runs (attest v4.2.1, login-action v4.6.0) rather than the older pins
  ci(deps): bump the release-0-1-actions-updates group with 2 updates #18 proposed.
• Per-job token scopes — write scopes moved from the workflow default to
  the single privileged job in release.yml and docs.yml. Effective
  permissions are unchanged today; a job added later starts with nothing.
• persist-credentials: false on 9 of 10 checkouts. The release job is the
  deliberate exception — it pushes the nested api/ module tag and breaks
  without it. Recorded at the step and in AGENTS.md so a future Scorecard alert
  is not "fixed" by breaking the tag push.

Deliberately out of scope

scorecard.yml and security.yml (also from #13) are not backported. Scorecard
analyses the default branch, and the govulncheck scheduled scan on main
already covers supported branches — neither belongs on the frozen line.

Test plan

• All 36 uses: resolve to a 40-character SHA
• Each of the 14 distinct SHAs cross-checked against the release tag named
  in its comment via the GitHub API (git/ref/tags + annotated-tag deref)
• All three workflows parse as YAML
• Resulting uses: set is identical to main's for the shared workflows
• CI green on this PR
• Next 0.1 release publishes (exercises the release job's retained token)