chore(ci): harden publish workflow

[hmchouaib]

Summary

• Make the publish and release workflows no-cache paths by adding a cache input to .github/actions/setup-node and calling it with cache: "false" from publish.yaml and release.yaml. This skips the shared pnpm/Nx cache composite and disables actions/setup-node package-manager caching while still running pnpm install --frozen-lockfile.
• Keep normal CI on the default cached setup path.
• Remove the redundant NPM_TOKEN authentication step from both publish.yaml
  and release.yaml — OIDC trusted publishing (id-token: write) is already configured and confirmed sufficient. The existing NPM_TOKEN in the org is expired (Mar 31, 2026) and has not been the active auth mechanism.
• Add persist-credentials: false to checkout steps that do not push.
• Pin amannn/action-semantic-pull-request in commitlint.yaml to an immutable commit SHA instead of the mutable v5.5.3 tag.
• Add CODEOWNERS coverage for .github/workflows/ and .github/actions/ using @storyblok/dx.
• Add persist-credentials: false and explicit contents: read permission to ci.yaml to prevent token leakage via git config.

Why

The publish and release jobs receive id-token: write for npm trusted
publishing, so they should not restore or save dependency/Nx caches that
could be influenced by other workflows. Strictly disabling caches in publish
is simpler and safer than maintaining a separate cache namespace for the
release path.

This mirrors the hardening applied to monoblok in #606 and was identified during a post-TanStack supply chain attack audit.

Test plan

• YAML parse for .github/workflows/* and .github/actions/*.
• git diff --check origin/main..HEAD.
• Confirmed publish.yaml keeps contents: read and id-token: write,
  uses persist-credentials: false, calls setup-node with cache: "false",
  and has no NPM_TOKEN authentication step.
• Confirmed release.yaml applies the same on both dry-run and release
  jobs, with no Configure npm authentication step.
• Confirmed ci.yaml still uses the default cached setup path.

Jira: https://storyblok.atlassian.net/browse/INFRA-911