[agent-api-doc Teammate] Harden GitHub Actions credential handling

[pplx-teammatebot]

Task: teammate-p0g

Why

The cookbook's GitHub Actions were rejected by the repository's full-SHA policy, and the cross-repository sync left a write-capable credential configured in Git for every subsequent step. The workflows also relied on mutable dependency installation during CI. These patterns increase CI supply-chain and credential-exposure risk.

What changed

• Pin every third-party action to a reviewed full commit SHA and give jobs explicit least-privilege permissions.
• Disable persisted checkout credentials and provide the docs credential only to the final push command, with derived authorization material masked.
• Separate commit-comment reporting into a job that alone receives contents: write.
• Use deterministic lockfile installs, disable project hooks in the trusted docs checkout, and repair/update the cookbook lockfile.
• Add concurrency controls, avoid expression interpolation in shell/JavaScript, and hard-code the intended docs repository rather than selecting it through a secret.

No credential value or suspected token material was inspected or included in this change.

Posted by Teammate.