Expand `step-security/harden-runner` to more workflows

Summary

The repository currently uses step-security/harden-runner in only 5 of 14 workflows. Expanding coverage to additional workflows would improve detection of compromised actions, unexpected network egress, and supply chain attacks.

Current Coverage

✅ Has harden-runner

Workflow	Trigger
codeql-analysis.yml	push/PR to main, schedule
dependency-review.yml	pull_request
go-coverage.yml	PR/push to main, schedule
scorecard.yml	push to main, schedule
woke.yml	pull_request

❌ Missing harden-runner

Workflow	Trigger	Priority
ci.yaml	pull_request	High — runs on every PR, executes Go builds/tests
nightly-builds.yaml	schedule, workflow_dispatch	High — publishes images, uses OCI/GHCR secrets
e2e-matrix.yml	workflow_call	Medium — runs e2e tests with cluster access
e2e-matrix-extras.yaml	repository_dispatch	Medium — runs e2e tests, uses CHATOPS_TOKEN
labels.yaml	pull_request	Low — read-only label checking
slash.yml	issue_comment	Low — dispatches to other workflows
chatops_retest.yaml	repository_dispatch	Low — delegates to plumbing workflow
cherry-pick-command.yaml	repository_dispatch	Low — delegates to plumbing workflow
rebase-command.yaml	repository_dispatch	Low — delegates to plumbing workflow

Recommendation

1. Start with audit mode (already used in existing workflows) — zero risk of breaking CI
2. Prioritize ci.yaml and nightly-builds.yaml — highest value targets due to secrets and build artifact production
3. Consider block mode for critical workflows once audit baselines are established — this would actively prevent compromised actions from exfiltrating data

Example

steps:
  - name: Harden Runner
    uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
    with:
      egress-policy: audit

Context

• harden-runner was instrumental in detecting the tj-actions/changed-files compromise (CVE-2025-30066)
• This repository already uses it in some workflows, so the pattern is established
• All existing usages are SHA-pinned ✅

Found during a security review of the repository's GitHub Actions configuration.