Harden GitHub Actions workflows

[djchen]

Summary

• add CODEOWNERS coverage for GitHub workflow security-sensitive files
• reduce workflow token exposure, disable checkout credential persistence, validate upstream release tags, and remove Docker publish cache usage
• add a blocking pinned zizmor workflow security scan
• replace the workflow_run Docker publish handoff with a reusable validation workflow and direct main/tag/manual publish triggers

Verification

• actionlint
• git diff --check
• PR checks passing

Notes

• bun run format:check was not run locally because bun is unavailable in this environment.
• Branch protection required check names may need review after the reusable workflow check contexts settle.