fix(actions): isolate persistent runner Git config

[rldyourmnd]

Summary

• isolate ambient global Git configuration before checkout in the five private-free/cross-tier workflows consumed by nddev-harnesses
• enforce exact pre-checkout ordering and script content in check_workflow_contracts.py
• require every public ci-workflows self-caller with a runner input to select ubuntu-latest explicitly
• update capability/runtime ledgers, generated docs, examples, runner guidance, and changelog

Observed consumer failure: a persistent self-hosted runner global http.https://github.com/.extraheader combined with the token configured by actions/checkout, causing GitHub HTTP 400 Duplicate header: Authorization. The workflows now use an empty job-unique global config under $RUNNER_TEMP; they neither read nor mutate runner global config.

Type of change

• New reusable workflow / capability
• Fix to an existing workflow
• Pinned tool/action version bump
• Hardening / security posture improvement
• Docs only

Threat-model note (required for workflow / permission changes)

The new pre-checkout step executes only immutable workflow-library code and consumes no caller content, credentials, or event text. It creates one mode-0600 empty file under the job-unique runner temp directory and exports only that path through GITHUB_ENV. This removes ambient persistent-runner Git configuration from the checkout trust boundary while leaving actions/checkout responsible for its scoped token. Privileged-event ref guards remain first where required. Public self-callers now select ubuntu-latest explicitly, preventing private-consumer defaults from routing public PR code to self-hosted infrastructure. No new network, secret, cache, artifact, or write surface is introduced.

Permissions diff (required for workflow / permission changes)

No permissions change. Top-level permissions: {} and every affected job retain their prior least-privilege scopes.

Checklist

• All third-party actions pinned to a full 40-char commit SHA with a # vX.Y.Z version comment.
• Least-privilege permissions preserved.
• Existing concurrency and timeout contracts preserved.
• persist-credentials: false remains on all affected checkouts.
• No untrusted expression interpolation was added to run:.
• No paid public/GHAS action was added to private-free/cross-tier files.
• actionlint passes locally.
• zizmor --pedantic has no template-injection or unpinned findings (10 pre-existing low undocumented-permissions findings remain in unrelated workflows).
• Catalog, runtime ledger, generated capability matrix, examples, and runner docs updated.
• CHANGELOG.md updated under [Unreleased].
• Commits are signed and signed off; Conventional Commit subjects.

Verification

• python3 scripts/validate_all.py — PASS
• actionlint — PASS
• uvx zizmor@1.26.1 --persona regular --min-severity low .github/workflows — no findings
• synthetic poisoned-global-config fixture — 1 header key before, 0 after, isolated file mode 0600
• python3 scripts/generate_docs.py --check — PASS
• git diff --check — PASS

Tier impact

• Public (free OSS suite)
• Private free tier (zero-cost only)
• Private paid tier (GHAS / harden-runner features)

Caller API and permissions are backward compatible; consumers opt in only by pinning the final commit.