⚙️ [Maintenance]: Harden workflow permissions and add YAML perf review harness

[Marius Storhaug (MariusStorhaug)]

This change hardens workflow secret and permission handling for PR paths, adds a repeatable Profiler-based performance harness for YAML command regressions, and closes release-readiness QA/UX gaps identified during PR #47 execution.

Changed

• Replaced broad reusable-workflow secret inheritance with explicit mapping for required secrets in .github/workflows/Process-PSModule.yml.
• Split workflow execution into PR and release-capable paths so open-PR runs use reduced permissions, while closed-PR/scheduled/manual paths retain publish-capable permissions.
• Added tests/tools/Invoke-YamlPerfReview.ps1 to run repeatable baseline/regression performance scenarios for core YAML commands.
• Updated tests/Packaging.Tests.ps1 to align with the current source layout on the release line (removed stale assumptions about src/manifest.psd1 and src/header.ps1).
• Normalized comment-based help .LINK metadata across public commands and fixed the Merge-Yaml link target to the correct merge section.

Validation

• Executed full Pester suite on this branch (Invoke-Pester -Path .\tests -CI): 475 passed, 0 failed, 8 skipped.
• Executed targeted command-surface tests for touched YAML commands and packaging updates.
• Executed help coverage audit for public commands: synopsis/examples/related links now present for each command.
• Executed Profiler baseline/regression runs using the new harness with the >5% critical-path slowdown gate.

Why base is release/v1.0.0

These changes are specific to the in-flight v1.0.0 release line and support PR #47 hardening plus release-readiness gates without mixing in unrelated main branch work.