ci: harden CI/CD pipeline security

[ryanrishi]

Summary

• Pin all GitHub Actions to commit SHAs in CI workflow (prevents tag hijacking attacks)
• Add top-level permissions: contents: read to CI workflow (least privilege)
• Add if: github.repository_owner == 'twilio' guard to deploy workflow (prevents fork abuse)
• Add github-actions ecosystem to dependabot configuration
• Add --exclude-newer quarantine (2-day) to all uv sync commands in CI (blocks recently-published packages)

Test plan

• CI passes on this branch
• Verify dependabot picks up the github-actions ecosystem
• Confirm --exclude-newer doesn't break installs (lockfile deps are all > 2 days old)

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR hardens the repository’s CI/CD posture by tightening GitHub Actions supply-chain security and minimizing default token permissions, while adding a Dependabot configuration to keep pinned actions up to date.

Changes:

• Pin GitHub Actions in the CI workflow to specific commit SHAs and add top-level least-privilege permissions: contents: read.
• Add a 2-day package “quarantine” to CI installs by applying uv sync --exclude-newer with a computed cutoff timestamp.
• Prevent deploy workflow job execution outside the upstream org by guarding jobs with if: github.repository_owner == 'twilio', and enable Dependabot updates for github-actions.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
.github/workflows/deploy.yml	Adds an org-owner guard to prevent fork-triggered deploy workflow execution.
.github/workflows/ci.yml	Pins actions to SHAs, restricts workflow token permissions, and adds uv sync --exclude-newer quarantine behavior.
.github/dependabot.yml	Adds github-actions ecosystem updates so pinned SHAs can be maintained automatically.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.