ci: cut PR runner waste and harden workflow permissions (#1226)

Pipeline audit follow-up: reduce wasted runner time on PRs and tighten CI
security, without reducing what actually gets validated.

Runner-time waste:
- Concurrency with PR-only cancel-in-progress on CI, E2E, and docker-build,
  so a new push cancels the previous commit's still-running checks. Non-PR
  runs use the unique run_id as the group, because GitHub keeps at most one
  pending run per group even with cancel-in-progress: false — a shared ref
  group could silently drop a queued master run.
- paths-ignore for docs-only changes (Markdown, docs/, .plans/, .codex/,
  .claude/) on the Electron build matrix and the E2E suites; E2E also skips
  apps/website/**. The build workflow keeps apps/website/** because its Linux
  job builds the website to verify AppStream assets. Tag pushes are
  unaffected: GitHub does not evaluate paths filters for tags.
- PRs lint affected projects only; master pushes keep the full run-many.
  Lint-global inputs (eslint.config.mjs, tools/eslint/**) now mark all 41
  lint projects affected, including the run-commands targets database and
  packaging, so the max-lines baseline cannot be widened without lint.

Hardening:
- Explicit least-privilege permissions on CI, E2E, and build-and-make; the
  create-release job keeps its job-level contents: write. The repository
  default workflow token was switched to read-only.
- New actionlint job (image pinned by digest, shellcheck at warning+), with
  the shared-anchor false positive suppressed in .github/actionlint.yaml.
  Fixed one real finding: unquoted $GITHUB_OUTPUT.
- .github/dependabot.yml: weekly cadence, minor+patch grouped per ecosystem
  (npm, GitHub Actions, Docker), majors stay individual PRs.

Docs updated: CLAUDE.md, docs/architecture/nx-workspace-boundaries.md, and
docs/architecture/validation-map.md now describe affected-lint on PRs and the
E2E path-filter exceptions.

docs/architecture/validation-map.md

@@ -30,8 +30,9 @@ pnpm run lint                 # nx run-many --target=lint --all
 pnpm nx lint <project>        # single project
 ```
 
-The CI workflow (`.github/workflows/ci.yml`) runs lint for every project on
-each PR. This enforces `@nx/enforce-module-boundaries` (scope/domain/type tag
+The CI workflow (`.github/workflows/ci.yml`) lints affected projects on PRs
+(`nx affected`) and every project on master pushes.
+This enforces `@nx/enforce-module-boundaries` (scope/domain/type tag
 constraints), the legacy bare-alias ban, and the `max-lines` file-size rule
 (hard maximum 400 lines per TypeScript file). Files that predate the
 `max-lines` rule are baselined in `tools/eslint/max-lines-baseline.mjs`; after
@@ -48,7 +49,11 @@ project is missing from the policy, a listed project no longer exists, or a
 Tier A entry has no test target. CI runs Tier A with coverage (uploaded to
 Codecov) and each Tier B/C project's `validationCommand` (falling back to
 `nx test`) without coverage; projects with an `e2e` target are skipped there
-because the E2E workflow already runs them on every PR.
+because the E2E workflow already runs them on every PR that touches app code.
+Docs-only changes (Markdown, `docs/`, `.plans/`, `.codex/`, `.claude/`) and
+`apps/website/**` changes skip the E2E workflow via `paths-ignore` — for those
+PRs no E2E validation runs in CI, which is intentional: they cannot affect app
+behavior.
 
 | Tier | Rule | Validation |
 | --- | --- | --- |