ci: least-privilege tokens on the two lanes that execute PR-controlled code

free-tests runs PR code (install lifecycle scripts + the suite) with
whatever the repo-default GITHUB_TOKEN grant is, persisted into
.git/config by checkout. Now: permissions contents:read,
persist-credentials false, pinned by the wiring test. actionlint gets
the same treatment plus a digest pin on the third-party Docker Hub
image (a tag is repointable with no GitHub-side audit trail, and the
image sees the mounted checkout). restore-keys added to both caches so
a lockfile bump warms from the previous cache; stale --parallel header
wording corrected.

.github/workflows/actionlint.yml

@@ -13,11 +13,20 @@ concurrency:
   group: actionlint-${{ github.head_ref || github.ref_name }}
   cancel-in-progress: true
 
+# Lint needs nothing from the token; the job runs a third-party image with
+# the checkout mounted, so keep the grant read-only and out of .git/config.
+permissions:
+  contents: read
+
 jobs:
   actionlint:
     runs-on: ubicloud-standard-2
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       # Pull the prebuilt image instead of rhysd/actionlint@v1.7.11 (a Docker
-      # action that rebuilt from source every run: 16s of a 44s job for 1s of lint).
-      - run: docker run --rm -v "$PWD:/repo" -w /repo rhysd/actionlint:1.7.11 -color
+      # action that rebuilt from source every run: 16s of a 44s job for 1s of
+      # lint). Pinned by DIGEST: a Docker Hub tag is repointable with no
+      # GitHub-side audit trail, and this image sees the mounted checkout.
+      - run: docker run --rm -v "$PWD:/repo" -w /repo rhysd/actionlint:1.7.11@sha256:6f03470d0152251d7f07f7c4dc019dbe7024c72cd952f839544c7798843efa8f -color