fix(ci): harden golden-path verifier token use

[DeployFaith]

Motivation

• Mitigate a CI supply-chain vulnerability where a pull_request job granted a write-capable GITHUB_TOKEN and checked out a mutable same-repo branch, allowing branch-controlled code to access repository credentials and push changes.

Description

• Change workflow permissions from contents: write to contents: read to remove write-capable tokens from the PR job.
• Checkout the immutable PR head with ref: ${{ github.event.pull_request.head.sha }} and set persist-credentials: false to prevent persisting the checkout credential into the job environment.
• Replace the workflow's commit/push step with a non-writing diff-reporting step so the job no longer performs repository writes.

Testing

• Ran a Python security invariant check that validated contents: read, immutable checkout ref, disabled credential persistence, and absence of git push, which succeeded.
• Parsed the modified workflow YAML with yaml.safe_load(...), which succeeded.
• Attempted npm run lint, npm run typecheck, and npm test from the repository root but they failed due to a missing root package.json (commands were not applicable to this repository layout).

---

Codex Task

[DeployFaith]

Superseded by #101, merged to main as 4133675 after all required GitHub checks passed.