fix: harden CI workflow — least-privilege token, timeouts, pinned ruff

[iap]

Summary

Workflow audit follow-ups (no behavior change to the product):

• Least privilege: top-level permissions: contents: read. The jobs only check out the repo and run tests; they previously inherited repo-default token scopes.
• Timeouts: timeout-minutes: 15 on all three jobs (current runs take <2 min; previously a hung step could burn up to 6h).
• Pinned ruff: ruff@0.16 → ruff@0.16.2, matching uv.lock, so a future 0.16.x rule change can't fail CI lint while local passes.

Deliberately untouched: setup-uv 0.5.x float. Local dev uv is 0.5.4 and uv releases are at 0.12.x — moving the toolchain generation is a separate decision for the restructure, not a drive-by in this PR.

Branch

Opened from fix/ci-workflow-hardening.

Note

Workflow-only change; no product code, no secrets touched.

Checklist

• Tests pass: python3 -m pytest tests/ -q
• verify.py is green
• No raw tokens/secrets in code, logs, or tool output
• Adapter stays loopback-only unless an explicit guard is added
• Updated docs/README if user-facing behavior changed (N/A)

Confidence Score: 5/5

Safe to merge.

What we checked:

• Installed the development dependencies and prepared the environment, then ran the complete tests suite with HERMES_HOME set to the repository and no PYTHONPATH override.
• The test suite finished with 230 passed and 3 skipped in 6.13 seconds, demonstrating the test job can run without checking out the Hermes sibling repository.

Summary

• Restricts repository permissions for the workflow, adds execution limits, and pins Ruff to the lockfile version.
• The updated test-job setup was exercised successfully without a Hermes sibling checkout.
• No issues were identified.

_{Reviews (1) · Last reviewed commit: "fix: harden CI workflow — least-privileg..."}