[RGood]

Summary

Applies mitigations M04 (declare job permissions) and M06 (pin actions) from the Reddit GitHub Actions hardening plan.

• Add top-level permissions: contents: read to ci.yaml. The test job only builds and tests, so it needs nothing more.
• Set persist-credentials: false on checkout. The job never pushes.
• Pin actions/checkout and actions/setup-node to full commit SHAs, with version comments (same commit the current tag points to).
• Add a github-actions ecosystem to Dependabot so the pins are updated automatically.

Testing

Check the CI run on this PR: the "GITHUB_TOKEN Permissions" section of the job log should show only Contents: read and Metadata: read, and the job should pass.

Notes

• Not Copybara-managed (no Copybara commits in recent history).
• Repo settings (token default read, no Actions PR approval, execution policy) are already applied. "Require full SHA pins" (M14) will be enabled only after this merges, so unpinned actions don't break CI.