security: harden publish workflow against Mini Shai-Hulud (pin + egress)

[nmccready]

Summary

Part of the Mini Shai-Hulud supply chain hardening campaign — closing OIDC hijack vectors in GitHub Actions publish pipelines across the brickhouse-tech org.

Changes

• Pin both brickhouse-tech/.github shared workflow refs (tests + publish) from @main to SHA 3c0bca8e1e161a6f61aee72413611b6fca239974
• Add top-level permissions: contents: read + id-token: write (was entirely missing)
• Add per-job permissions on the publish job for defense-in-depth

Threat model

Unpinned @main refs on shared workflows allow an attacker who pushes to the .github repo's main branch (or hijacks via OIDC) to inject arbitrary steps into every caller's publish run. Missing permissions means the GITHUB_TOKEN has default write-all scope — a much larger blast radius if compromised.

Precedent

Same pattern already merged in:

• chore(security): harden shared publish workflow vs Mini Shai-Hulud .github#7
• chore(security): harden publish workflow vs Mini Shai-Hulud node-xml2js#6
• chore(security): pin reusable publish workflow SHA (mini shai-hulud) angular.js#10
• chore(security): pin reusable publish workflow SHA (mini shai-hulud) json-schema#4

Test plan

• SHA 3c0bca8e1e161a6f61aee72413611b6fca239974 matches a reviewed commit on brickhouse-tech/.github
• Publish workflow still triggers and delegates correctly to the shared workflow