CI Pipeline Hardening

Harden a CI pipeline with least-privilege tokens, protected branches and signed artifacts.

• security
• harden