chore: harden actions trust boundaries

[banteg]

What

Harden GitHub Actions trust boundaries after the recent Mini Shai-Hulud/GitHub Actions supply-chain activity.

This does not reduce test coverage. It keeps PR checks intact while separating untrusted PR execution from jobs that can publish packages, push container images, request OIDC tokens, or write repository contents.

Changes

• Add explicit read-only default permissions to the main test workflow.
• Make the PyPI release workflow request only contents: read and id-token: write, and stop restoring the setup-uv cache in that publish path.
• Split docs into two jobs:
  • docs runs for pull requests with contents: read.
  • publish-docs runs for push/release events with contents: write, preserving the gh-pages publish path.
• Split the container workflow trust boundary:
  • PR build jobs are read-only and use pr-... cache scopes.
  • Push/release publish jobs keep GHCR/attestation/OIDC permissions and use trusted-... cache scopes.

Why

The main risk is not pull_request_target here; Ape does not use it. The remaining low-hanging hardening is avoiding shared trust between PR jobs and publish jobs:

• untrusted PR code should not run in jobs with package publish or OIDC permissions;
• trusted publish jobs should not restore cache entries written by untrusted PR runs;
• release jobs should avoid dependency/tool cache restore where the time saving is not worth the trust boundary.

Validation

• pre-commit run --files .github/workflows/build.yaml .github/workflows/docs.yaml .github/workflows/publish.yaml .github/workflows/test.yaml
• ruby -e 'require "yaml"; Dir[".github/workflows/*.{yml,yaml}"].each { |f| YAML.load_file(f); puts "ok #{f}" }'
• git diff --check

[github-actions]

This pull request is considered stale because it has been open 30 days with no activity. Remove stale label, add a comment, or make a new commit, otherwise this PR will be closed in 5 days.