security: harden publish workflow against Mini Shai-Hulud (pin + egress)

[nmccready]

Summary

Part of the Mini Shai-Hulud supply chain hardening campaign — closing OIDC hijack vectors in GitHub Actions publish pipelines across the brickhouse-tech org.

Changes

• Pin brickhouse-tech/.github shared workflow ref from @main to SHA 3c0bca8e1e161a6f61aee72413611b6fca239974
• Permissions (contents: read, id-token: write) already present at workflow level — verified and left intact

Threat model

Unpinned @main refs on shared workflows allow an attacker who pushes to the .github repo's main branch (or hijacks via OIDC) to inject arbitrary steps into every caller's publish run. Pinning to a SHA locks the caller to a known-good version.

Precedent

Same pattern already merged in:

• chore(security): harden shared publish workflow vs Mini Shai-Hulud .github#7
• chore(security): harden publish workflow vs Mini Shai-Hulud node-xml2js#6
• chore(security): pin reusable publish workflow SHA (mini shai-hulud) angular.js#10
• chore(security): pin reusable publish workflow SHA (mini shai-hulud) json-schema#4

Test plan

• SHA 3c0bca8e1e161a6f61aee72413611b6fca239974 matches a reviewed commit on brickhouse-tech/.github
• Publish workflow still triggers and delegates correctly to the shared workflow