GitHub Actions Pipeline Hardening
Close the CI holes behind the 2025-26 supply-chain attacks - fixed in a pull request you review.
- Every workflow scored and explained
- Actions pinned, tokens least-privilege, AWS keys replaced by OIDC
- CI checks so it stays fixed