Harden GitHub Actions workflows

Pin all actions to full commit SHAs so a compromised upstream tag cannot
silently repoint at malicious code, and scope GITHUB_TOKEN permissions
down from the repo default.

Split the GitHub Pages deploy into its own job so the write token is
never present while dependency code runs (npm ci, build, tests).

Bump codeql-action v2 -> v3; v2 was sunset in early 2025.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>