fix(security): complete sanitizeLogValue sweep, DOMParser stripHtml, least-privilege CI permissions, pin Dockerfile image

.github/workflows/release.yml

@@ -11,12 +11,7 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event_name == 'workflow_dispatch' && 'release' || format('pr-{0}', github.event.pull_request.number) }}
   cancel-in-progress: ${{ github.event_name != 'workflow_dispatch' }}
 
-permissions:
-  actions: read
-  contents: write
-  issues: write
-  pull-requests: write
-  packages: write
+permissions: read-all
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"