Audit GitHub Actions workflows against mutable branch refs, excessive GITHUB_TOKEN permissions, and pull_request_target hazards.