PR builds are now handled by the dedicated pr.yml workflow
which uses bakery-build-pr.yml (fork-safe, no secrets).

The if condition referenced cron '15 3 * * 0' but the actual
schedule is '15 4 * * 0'. With pull_request removed, simplify
to check event_name directly instead of matching cron strings.

Set top-level permissions: {} on all workflows and per-job
permissions: {} on CI meta-jobs and the issues job. This
follows the principle of least privilege by requiring each
job to explicitly declare the permissions it needs.

Top-level permissions on workflows that call reusable
workflows acts as a ceiling, blocking job-level grants
from reaching the callee. Remove it from all workflows
except issues.yml (which doesn't call reusable workflows).
Per-job permissions remain.

Mutable tags can be overwritten, allowing supply chain
attacks. Pin to immutable commit SHAs with specific
version comments so Dependabot can track updates.

Add zizmor job to PR workflows and a .github/zizmor.yml
policy that allows ref-pinned images-shared refs while
requiring hash-pinning for all third-party actions.

The release workflow was the only workflow without explicit
permissions, inheriting the repo default. Add least-privilege
permissions (contents:write, pull-requests:write) to match
what product-release.yml needs, plus a 10-minute timeout.

- Downgrade packages:write to packages:read on PR build jobs —
  PR builds never push, cache is read-only
- Add security-events:write to zizmor job for SARIF upload to
  the Security tab

Add workflow_dispatch to the session build job's if condition —
it was excluded, making manual dispatch a no-op despite the push
input already handling it.

Grant packages: write on PR caller jobs so bakery-build-pr.yml
can write to GHCR caches on internal PRs. Fork PRs are unaffected
by GitHub's platform-enforced read-only token.

Remove stale concurrency comments referencing pull_request trigger
which no longer exists on these workflows. Replace archived
actions-ecosystem/action-add-labels with gh issue edit.

GitHub creates a check run for modified workflow files on push
even when the file only triggers on workflow_dispatch. The run
fails because inputs.version is undefined in a push context.