- ci.yml declares permissions: contents: read instead of the default
token scope.
- Every action is pinned to the commit its current tag points at
(checkout v4.4.0, upload-artifact v4.6.2, action-gh-release v2.6.2),
so a moved tag can't change what runs with release write access.
- A cargo audit job runs on every push; the single ignored advisory
(RUSTSEC-2023-0071, rsa via russh, no fix available) is recorded with
its rationale in rust/.cargo/audit.toml (SEC-20261012-019, -012).
Release signing and macOS notarisation are not part of this change.
