fix(ci): drop persisted checkout credentials and pass matrix.tool through env (#658)

* fix(ci): drop persisted checkout credentials and pass matrix.tool through env

All nine actions/checkout steps left the job token in .git/config for
every later step, including bun install and bun test in CLI code a pull
request brings (zizmor artipacked). Each now sets
persist-credentials: false; no step needed the stored credential.

cli-checks expanded ${{ matrix.tool }} - a directory name discover-clis
reads from the PR's tree - into its shell script (zizmor
template-injection). It now arrives through env.

upstream-watch.yml grants issues: write to its one job rather than the
whole workflow.

The new stdlib-only test reproduces zizmor's findings on master exactly
(9 artipacked, 1 template-injection at ci.yml:227) and passes here.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* changelog: place the #658 entry under [Unreleased]

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Mads Lorentzen <madslorentzen_17@hotmail.com>

CHANGELOG.md

@@ -193,6 +193,21 @@ per-file diff commands.
   web search only for that last escalation step, finding the employer's own copy of the posting; company research and salary
   lookups stay out of `/rank`.
 
+### Security
+
+- **CI no longer leaves the job token in `.git/config` or expands a PR-controlled name into a
+  script** (#658, `.github/workflows/ci.yml`, `.github/workflows/upstream-watch.yml`,
+  `tests/test_workflow_hardening.py`) - all nine `actions/checkout` steps persisted the job token
+  for every later step, including `bun install` and `bun test` in CLI code a pull request brings
+  (zizmor `artipacked`); each now sets `persist-credentials: false`, which nothing needed. The
+  `cli-checks` test step expanded `${{ matrix.tool }}` - a directory name `discover-clis` reads
+  from the PR's tree - straight into its shell script (zizmor `template-injection`); it now
+  arrives through `env`. `upstream-watch.yml` grants `issues: write` to its one job instead of
+  the whole workflow, so a job added later starts read-only. The container images stay on tags:
+  the `texlive/texlive:latest` leg exists to track current TeX Live, and a digest pin without
+  automated updates would freeze both legs. The test reads the workflow text with the stdlib, so
+  it needs neither zizmor nor PyYAML.
+
 ## [1.7.3] - 2026-10-19
 
 ### Added