Harden configuration and CI security

[TimInTech]

Summary

• Parse /etc/pmanrc and ~/.pmanrc as allowlisted data instead of executing them as shell code.
• Require private, owner-controlled log files and reject symlink targets.
• Install pman as an atomic root-owned copy instead of a symlink to a mutable checkout.
• Prevent user-controlled output from being interpreted as printf %b escape sequences.
• Pin GitHub Actions to immutable commits, verify downloaded tools by checksum, minimize permissions, remove persisted checkout credentials, and replace the third-party release action with gh release.
• Restore README secret scanning, upgrade Gitleaks, and add weekly GitHub Actions updates with a security cooldown.

Root cause

The previous implementation trusted configuration files as executable shell input, followed a repository symlink for the privileged system command, and relied on mutable or unverified CI dependencies.

Impact

Configuration remains compatible for the three documented settings, but arbitrary shell syntax is ignored. Existing log files must be owner-controlled with mode 0600. Updating the checkout now requires rerunning the installer to refresh /usr/local/bin/pman.

Validation

• 41 repository tests passed
• Bash syntax, ShellCheck, shfmt, and git diff --check passed
• Actionlint passed
• Zizmor pedantic audit: 0 findings
• Gitleaks full-history, worktree, and staged scans: 0 findings
• Immutable-action and unsafe-download-pipeline checks passed
• Atomic installer symlink-replacement test passed