[vigilanty0x]

What changed

• Pins GitHub Actions dependencies to audited full commit SHAs.
• Adds a top-level least-privilege contents: read permission.

Why

The portfolio audit found mutable action references and missing explicit token permissions. This change reduces workflow supply-chain drift and limits the default GitHub Actions token.

Impact

CI configuration only; no runtime or package behavior changes.

Validation

• Remote main matched the audited baseline before the branch was pushed.
• The proposal is one clean commit changing only .github/workflows/ci.yml.
• Workflow YAML parsed successfully.
• The hardening transform is idempotent.
• Exact action SHAs and evidence checksums were verified.

This PR remains draft pending repository CI and human review.

[vigilanty0x]

Superseded by the tested canonical package in vigilanty0x/promptops at packages/answer-diff. The canonical PromptOps workflow already pins actions, uses least-privilege permissions, and tests this package across Python 3.11-3.14. Archive-only consolidation was approved and verified in promptops PR #34; this source repository is being preserved read-only, never deleted.