fix: tighten workflow permissions, add security hardening, and fix uv tool invocations

[jmeridth]

What

Move elevated permissions from workflow level to job level across four workflows (mark-ready-when-ready, scorecard, stale, contributor_report) so each job only holds the permissions it actually needs. Add step-security/harden-runner to all eight workflows that define steps. Add CodeQL SAST scanning and dependency-review workflows. Add pre-commit configuration with gitleaks, formatting hooks, and local linter hooks. Fix Makefile to invoke flake8, pytest, pylint, and mypy via uv run python -m since they lack console script entry points in the uv venv. Upgrade PyJWT from 2.11.0 to 2.12.1 to address CVE-2026-32597.

Why

Workflow-level write permissions apply to every job in the workflow, granting broader access than necessary. Moving them to job level follows the principle of least privilege. Harden-runner audits outbound network calls from GitHub-hosted runners, improving supply-chain visibility. CodeQL and dependency-review close gaps in static analysis and vulnerable-dependency detection. The Makefile commands failed under uv because those packages don't install console scripts; python -m ensures the tools are always found. PyJWT <= 2.11.0 doesn't validate the RFC 7515 crit header parameter (CVSS 7.5).

Notes

• The uv run to uv run python -m change also affects CI since python-package calls make lint and make test
• release.yml, auto-labeler.yml, and pr-title.yml use reusable workflows at the job level so harden-runner cannot be added there; it must go in the reusable workflow definitions instead
• pylint was also changed to python -m beyond what the upstream stale-repos PR did, since it failed the same way as flake8/mypy/pytest
• PyJWT is a transitive dependency; verify downstream consumers aren't relying on the old crit-header-ignored behavior
• The scorecard workflow previously used permissions: read-all which granted read access to all scopes; now explicitly scoped to only what's needed

[Copilot]

Pull request overview

This PR strengthens the repo’s supply-chain/security posture and dev tooling by adding pre-commit hooks, tightening GitHub Actions permissions, hardening runners, and updating a dependency lock entry.

Changes:

• Add a .pre-commit-config.yaml with gitleaks + Python formatting/lint/type-check hooks.
• Harden multiple GitHub Actions workflows (runner hardening + more granular permissions) and add new Dependency Review + CodeQL workflows.
• Bump pyjwt in uv.lock and adjust Makefile commands to run tools via python -m ....

Reviewed changes

Copilot reviewed 12 out of 14 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
uv.lock	Updates locked pyjwt version and artifact hashes/URLs.
Makefile	Runs pytest/flake8/pylint/mypy via python -m under uv run.
.pre-commit-config.yaml	Introduces pre-commit hooks for secrets scanning and Python tooling.
.github/workflows/stale.yaml	Adds runner hardening and scopes permissions at job level.
.github/workflows/scorecard.yml	Adds runner hardening and narrows default permissions.
.github/workflows/python-package.yml	Adds runner hardening to CI test workflow.
.github/workflows/mark-ready-when-ready.yml	Moves elevated permissions to job level and adds runner hardening.
.github/workflows/linter.yaml	Adds runner hardening to the linter workflow.
.github/workflows/docker-image.yml	Adds runner hardening to Docker build workflow.
.github/workflows/dependency-review.yml	Adds dependency review workflow for PR dependency changes.
.github/workflows/copilot-setup-steps.yml	Adds runner hardening to Copilot setup steps.
.github/workflows/contributor_report.yaml	Adds runner hardening and adjusts permissions structure.
.github/workflows/codeql.yml	Adds CodeQL scanning workflow with pinned actions and runner hardening.

[zkoppert]

The Autobuild step in codeql.yml is a no-op for Python since CodeQL analyzes source directly without a build step. Please remove the Autobuild step and its surrounding comments to keep the workflow clean.

[zkoppert]

LGTM - minor note: consider removing the Autobuild step from codeql.yml since it's a no-op for Python.