fix(security): complete sanitizeLogValue sweep, DOMParser stripHtml, least-privilege CI permissions, pin Dockerfile image

.github/workflows/e2e-runner.yml

@@ -43,6 +43,9 @@ jobs:
     name: ${{ inputs.check-name }}
     runs-on: ubuntu-latest
     timeout-minutes: ${{ inputs.job-timeout-minutes }}
+    permissions:
+      contents: read
+      checks: write
     services:
       postgres:
         image: pgvector/pgvector:pg16

.github/workflows/e2e.yml

@@ -14,9 +14,7 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions:
-  contents: read
-  checks: write
+permissions: read-all
 
 env:
   NODE_VERSION: "24"
@@ -26,6 +24,8 @@ jobs:
     name: Build Suite Matrix
     runs-on: ubuntu-latest
     timeout-minutes: 5
+    permissions:
+      contents: read
     outputs:
       matrix: ${{ steps.build.outputs.matrix }}
     steps:
@@ -48,6 +48,9 @@ jobs:
       fail-fast: false
       matrix:
         suite: ${{ fromJSON(needs.setup.outputs.matrix) }}
+    permissions:
+      contents: read
+      checks: write
     uses: ./.github/workflows/e2e-runner.yml
     with:
       suite-id: ${{ matrix.suite.id }}

.github/workflows/release.yml

@@ -11,12 +11,7 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event_name == 'workflow_dispatch' && 'release' || format('pr-{0}', github.event.pull_request.number) }}
   cancel-in-progress: ${{ github.event_name != 'workflow_dispatch' }}
 
-permissions:
-  actions: read
-  contents: write
-  issues: write
-  pull-requests: write
-  packages: write
+permissions: read-all
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"