chore: align GitHub Actions with other projectwallace repositories

[bartveneman]

• lock down permissions
• split publish into separate jobs
• add 7 day cooldown to dependabot
• add ✂️ Knip

[github-actions]

⚠️ Dependency Count

This PR adds 54 new dependencies (229 → 283), which exceeds the threshold of 10.

⚠️ Duplicate Dependencies (found: 2, threshold: 2)

📦 Package	📋 Versions
@emnapi/core	3 versions root@ @vitest/coverage-v8@4.1.10 ... rolldown@1.1.5 @rolldown/binding-wasm32-wasi@1.1.5 @emnapi/core@1.11.1 root@ knip@6.31.0 oxc-parser@0.142.0 @oxc-parser/binding-wasm32-wasi@0.142.0 @emnapi/core@1.11.2 root@ tsdown@0.22.14 rolldown@1.2.1 @rolldown/binding-wasm32-wasi@1.2.1 @emnapi/core@2.0.0-alpha.3
@emnapi/runtime	3 versions root@ @vitest/coverage-v8@4.1.10 ... rolldown@1.1.5 @rolldown/binding-wasm32-wasi@1.1.5 @emnapi/runtime@1.11.1 root@ knip@6.31.0 oxc-parser@0.142.0 @oxc-parser/binding-wasm32-wasi@0.142.0 @emnapi/runtime@1.11.2 root@ tsdown@0.22.14 rolldown@1.2.1 @rolldown/binding-wasm32-wasi@1.2.1 @emnapi/runtime@2.0.0-alpha.3

💡 To find out what depends on a specific package, run: pnpm -r why example-package

📊 Dependency Size Changes

Warning

This PR adds 17.8 MB of new dependencies, which exceeds the threshold of 100 kB.

📦 Package	📏 Size
zod@4.4.3	4.6 MB
@oxc-resolver/binding-linux-x64-gnu@11.24.2	2.1 MB
@oxc-parser/binding-linux-x64-gnu@0.142.0	2.1 MB
@emnapi/core@1.11.2	2 MB
knip@6.31.0	1.9 MB
jiti@2.7.0	1.8 MB
oxc-parser@0.142.0	1.4 MB
yaml@2.9.0	686 kB
@emnapi/runtime@1.11.2	433.6 kB
smol-toml@1.7.1	206.1 kB
unbash@4.0.4	186 kB
get-tsconfig@4.14.0	163.2 kB
oxc-resolver@11.24.2	61.4 kB
formatly@0.3.0	21.6 kB
strip-json-comments@5.0.3	8.2 kB
fd-package-json@2.0.0	7.7 kB
walk-up-path@4.0.0	6.1 kB

Total size change: 17.8 MB

⚠️ Package Size Increase

📦 Package	📏 Base Size	📏 Source Size	📈 Size Change
@projectwallace/format-css	8.7 kB	8.7 kB	+26 B