fix(ci): prevent pull request cache writes (#1688)

* fix(ci): harden workflows against cache poisoning and document unsigned tags

- Restrict TURBO_TOKEN/TURBO_TEAM to main-branch pushes only across
  ci.yml, code-quality.yml, and react-doctor.yml. First-party PR branches
  no longer have cache write access (preventing cache poisoning attacks).
  PRs run with a cold cache.

- Add SECURITY comments in action-version-bump.yml explaining that tags
  are unsigned and recommending SHA pinning for hardened CI.

- Update install-github-workflow.ts template to include security note
  about @v2 floating major tag and SHA pinning recommendation.

Closes #1685

Co-authored-by: Skosh <skoshx@users.noreply.github.com>

* fix(ci): make pull request cache read-only

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Skosh <skoshx@users.noreply.github.com>
Co-authored-by: Aiden Bai <aiden@million.dev>