fix(security): complete sanitizeLogValue sweep, DOMParser stripHtml, least-privilege CI permissions, pin Dockerfile image

.github/workflows/e2e.yml

@@ -14,9 +14,7 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions:
-  contents: read
-  checks: write
+permissions: read-all
 
 env:
   NODE_VERSION: "24"
@@ -26,6 +24,8 @@ jobs:
     name: Build Suite Matrix
     runs-on: ubuntu-latest
     timeout-minutes: 5
+    permissions:
+      contents: read
     outputs:
       matrix: ${{ steps.build.outputs.matrix }}
     steps:
@@ -48,6 +48,9 @@ jobs:
       fail-fast: false
       matrix:
         suite: ${{ fromJSON(needs.setup.outputs.matrix) }}
+    permissions:
+      contents: read
+      checks: write
     uses: ./.github/workflows/e2e-runner.yml
     with:
       suite-id: ${{ matrix.suite.id }}