fix(ci): harden self-hosted workflow trust boundaries

Keep active CCS workflows on self-hosted runners, gate self-hosted PR execution to trusted authors, and scope privileged release credentials to the exact git operations that need them.

tests/unit/scripts/github/ci-workflow.test.ts

@@ -9,6 +9,8 @@ function resolvePath(relativePath: string) {
 describe('pr ci workflow', () => {
   test('keeps full coverage on pull requests', () => {
     const workflowPath = resolvePath('../../../../.github/workflows/ci.yml');
+    const trustedAuthorGate =
+      'contains(fromJSON(\'["COLLABORATOR","MEMBER","OWNER"]\'), github.event.pull_request.author_association)';
 
     expect(fs.existsSync(workflowPath)).toBe(true);
 
@@ -17,6 +19,7 @@ describe('pr ci workflow', () => {
     expect(workflow).toContain('name: CI');
     expect(workflow).toContain('pull_request:');
     expect(workflow).toContain('branches: [main, dev]');
+    expect(workflow.split(trustedAuthorGate).length - 1).toBe(3);
     expect(workflow).toContain('group: ci-${{ github.ref }}');
     expect(workflow).toContain('cancel-in-progress: true');
     expect(workflow).toContain('fail-fast: false');