[codex] Harden GitHub Actions permissions

[jbeckwith-oai]

Summary

Harden the GitHub Actions configuration based on the workflow security audit:

• Set explicit read-only default GITHUB_TOKEN permissions for CI.
• Remove unnecessary checkout and contents: write from the release-creation dispatcher.
• Keep Stainless private-module git credential config in a temp global config file instead of the runner home config.
• Pass branch-derived values through environment variables before shell use.
• Stop tracing artifact-upload commands and remove verbose curl output that could expose OIDC tokens or signed upload URLs.

Validation

• bash -n scripts/utils/upload-artifact.sh
• YAML parse check for all workflow/composite action files
• SHA-pin scan for external uses: references
• git diff --check

Notes

All external GitHub Actions references remain pinned to full commit SHAs.