Harden CI workflow (least-privilege, SHA-pinned actions, concurrency) (#5)

- Add a least-privilege `permissions: contents: read` block.
- Pin actions to commit SHAs and move to v6 (runs on the Node 24 action runtime, clearing the Node 20 deprecation warning).
- Cancel superseded runs for the same ref via concurrency.
- Add .nvmrc (24) and a package.json engines floor (>=22).

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: ShiosOS

.github/workflows/ci.yml

@@ -5,13 +5,25 @@ on:
     branches: [main]
   pull_request:
 
+# Least privilege: this workflow only needs to read the repo.
+permissions:
+  contents: read
+
+# Cancel superseded runs for the same ref to save CI minutes.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      # Actions are pinned to commit SHAs (supply-chain hardening); the
+      # trailing comment records the human-readable version. v6 runs on the
+      # Node 24 action runtime, clearing the Node 20 deprecation warning.
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24
           cache: npm

.nvmrc

@@ -0,0 +1 @@
+24

package.json

@@ -3,6 +3,9 @@
   "version": "1.1.0",
   "description": "Dev tooling for the GitHub PR Reverse Comments browser extension. The extension itself has no build step; these scripts only lint, format, test, and package it.",
   "private": true,
+  "engines": {
+    "node": ">=22"
+  },
   "scripts": {
     "lint": "eslint .",
     "format": "prettier --write .",