[codex] fix security alerts

[parithosh]

Summary

Mirrors the workflow hardening landed in ethpandaops/assertoor#183.

• Drops caller-controlled ref inputs from reusable check/build workflows so reusable jobs check out the event SHA instead of arbitrary PR-provided refs.
• Moves the PR build workflow (build-dev.yml) from pull_request_target to pull_request and adds explicit read-only default permissions.
• Splits PR binary builds from Docker publishing so fork PRs do not receive DockerHub secrets, while same-repository / manual trusted Docker publishing remains available.
• Adds explicit workflow permissions and switches internal artifact handoffs to artifact IDs to avoid artifact-name poisoning.

Validation

• actionlint clean

🤖 Generated with Claude Code

[qu0b-reviewer]

🤖 qu0b-reviewer

Summary

The PR addresses GitHub Actions security alerts by: (1) removing the pull_request_target trigger (which ran with write permissions on the base branch), replacing it with pull_request which only needs read permissions; (2) adding explicit permissions: contents: read declarations (principle of least privilege); (3) removing the ref input to reusable workflows (which was being used to parameterize actions/checkout ref — eliminating an unnecessary indirection point); (4) switching from hardcoded artifact names to artifact IDs for inter-job artifact passing. The changes are well-scoped and the security reasoning is sound.

Issues

No blockers. The changes are procedurally correct.

Suggestions

• .github/workflows/build-dev.yml:52 — build_binaries (the no-docker job) passes no release: input to the reusable workflow. Versus the docker job at line 63, which does pass it (empty string is the default, so it's functionally identical — but it's inconsistent and could break silently if the shared workflow's default ever changed). Underscore as a concern, not a blocker.

NO_REVIEW_NEEDED

---

_{Reviewed @ f9633f09
"Hofstadter's Law: It always takes longer than you expect, even when you take into account Hofstadter's Law." — Douglas Hofstadter}