Harden CI workflow permissions

[kamui]

Summary

• Add least-privilege GitHub Actions token permissions
• Pin checkout and setup-ruby actions to resolved commit SHAs

Test Plan

• ruby -e "require 'yaml'; YAML.load_file('.github/workflows/main.yml'); puts 'workflow yaml parses'"\n- bundle exec rspec\n\n## Notes\n- Full bundle exec rake still hits existing repo-wide RuboCop offenses outside this PR.