fix(ci): harden GitHub Actions workflows

[LuisUrrutia]

Summary

• Security: Fix script injection in CLA workflow by replacing direct ${{ }} interpolation in run: blocks with env: blocks
• Security: Add explicit job-level permissions to the release job for defense-in-depth
• Maintenance: Update outdated actions (setup-node v4→v6, checkout v6.0.1→v6.0.2, pnpm/action-setup v4.1→v4.2, sbom-action v0.22.1→v0.22.2, codeql-action v4.32.0→v4.32.2)
• Correctness: Fix incorrect version comment on SLSA secure-attestations-download (was v1.6.0, actually an untagged main commit)
• Correctness: Add missing version comments on pinned action SHAs across publish.yml
• CI: Add concurrency control to cancel in-progress CI runs on new pushes
• Cleanup: Remove unused single-entry matrix strategy, deduplicate PR number extraction in CLA labeling steps, quote all shell variables

Test plan

• CI workflow passes (build, test, lint, typecheck)
• CLA workflow triggers correctly on pull_request_target and issue_comment events
• Release workflow still creates release PRs and publishes to npm
• Scorecard workflow uploads SARIF results
• Verify actions/setup-node v6 major upgrade doesn't break node setup/caching