ci: cut PR runner waste and harden workflow permissions (#1226)

Pipeline audit follow-up: reduce wasted runner time on PRs and tighten CI
security, without reducing what actually gets validated.

Runner-time waste:
- Concurrency with PR-only cancel-in-progress on CI, E2E, and docker-build,
  so a new push cancels the previous commit's still-running checks. Non-PR
  runs use the unique run_id as the group, because GitHub keeps at most one
  pending run per group even with cancel-in-progress: false — a shared ref
  group could silently drop a queued master run.
- paths-ignore for docs-only changes (Markdown, docs/, .plans/, .codex/,
  .claude/) on the Electron build matrix and the E2E suites; E2E also skips
  apps/website/**. The build workflow keeps apps/website/** because its Linux
  job builds the website to verify AppStream assets. Tag pushes are
  unaffected: GitHub does not evaluate paths filters for tags.
- PRs lint affected projects only; master pushes keep the full run-many.
  Lint-global inputs (eslint.config.mjs, tools/eslint/**) now mark all 41
  lint projects affected, including the run-commands targets database and
  packaging, so the max-lines baseline cannot be widened without lint.

Hardening:
- Explicit least-privilege permissions on CI, E2E, and build-and-make; the
  create-release job keeps its job-level contents: write. The repository
  default workflow token was switched to read-only.
- New actionlint job (image pinned by digest, shellcheck at warning+), with
  the shared-anchor false positive suppressed in .github/actionlint.yaml.
  Fixed one real finding: unquoted $GITHUB_OUTPUT.
- .github/dependabot.yml: weekly cadence, minor+patch grouped per ecosystem
  (npm, GitHub Actions, Docker), majors stay individual PRs.

Docs updated: CLAUDE.md, docs/architecture/nx-workspace-boundaries.md, and
docs/architecture/validation-map.md now describe affected-lint on PRs and the
E2E path-filter exceptions.

.github/workflows/build-and-make.yaml

@@ -1,16 +1,46 @@
 name: Build and Make Electron App
 
+# Docs-only changes never affect the packaged app, so they skip the build
+# matrix. apps/website/** is intentionally NOT ignored: the Linux build job
+# builds the website to verify AppStream screenshot assets. Tag pushes are
+# unaffected — GitHub does not evaluate paths filters for tags, so v* release
+# builds always run.
+#
+# Known accepted edge case: if a PR built a test-pr-<n> draft and later
+# reverts its code changes so the remaining diff is docs-only, new pushes
+# skip this workflow and the draft keeps assets from the older commit. The
+# draft's title/body name the exact commit they were built from, and
+# cleanup-pr-draft.yml deletes the draft when the PR closes, so the stale
+# window is visible and bounded; refreshing drafts on skipped runs is not
+# worth a separate workflow.
 on:
     push:
         branches:
             - master
         tags:
             - 'v*.*.*'
+        paths-ignore:
+            - '**/*.md'
+            - 'docs/**'
+            - '.plans/**'
+            - '.codex/**'
+            - '.claude/**'
     pull_request:
         branches:
             - master
+        paths-ignore:
+            - '**/*.md'
+            - 'docs/**'
+            - '.plans/**'
+            - '.codex/**'
+            - '.claude/**'
     workflow_dispatch:
 
+# Build jobs only read the repo; the create-release job raises itself to
+# contents: write at the job level to manage the rolling draft release.
+permissions:
+    contents: read
+
 jobs:
     linux-embedded-mpv-runtime:
         name: Build pinned Linux Embedded MPV runtime
@@ -1389,7 +1419,7 @@ jobs:
 
             - name: Get version from package.json
               id: package-version
-              run: echo "version=$(node -p "require('./package.json').version")" >> $GITHUB_OUTPUT
+              run: echo "version=$(node -p "require('./package.json').version")" >> "$GITHUB_OUTPUT"
 
             # Test drafts (PR/master) get a self-describing title plus a context
             # header linking the PR, real head commit, and workflow run. A stable