Define shared GitHub Actions security policy checks #6

Goal

Define and enforce the shared GitHub Actions security baseline after the workflow distribution path was validated end to end.

Implemented policy

Mandatory rules:

• external Actions are pinned to a full 40-character commit SHA;
• human-readable version comments are kept next to pins when known;
• actions/checkout uses persist-credentials: false;
• permissions: write-all is forbidden;
• workflows use explicit least-privilege permissions;
• exceptions must be documented and justified.

Enforcement

• scripts/check_workflow_policy.py provides deterministic policy checks;
• tests/test_workflow_policy.py covers accepted and rejected cases;
• .github/workflows/workflow-policy.yml runs the policy in CI;
• actionlint remains responsible for workflow correctness;
• zizmor remains responsible for broader GitHub Actions security analysis;
• exception and governance guidance is documented in docs/security-policy.md.

Repository rulesets and required-check enforcement remain owned by LibreCodeCoop/github-governance.

Implemented in #60.