Pin every action to a commit SHA whose tag comment matches (verified via gh api), add least-privilege permissions, set persist-credentials: false, and replace the archived actions-rs/cargo with a plain cargo test. zizmor clean at default persona.