fix: restrict secret workflows to org members - #83

Summary

• keep pull request checks unprivileged; run preview deployment from a default-branch workflow_run only after checks pass
• require the effective triggering actor, including rerunners, to be a current tempoxyz member before preview deploy/destroy, external sweep requests, or production jobs can reach secrets
• load preview cleanup from the default branch with pull_request_target and never check out PR code
• replace nondefault-ref manual dispatch with default-branch repository_dispatch; remove unused dispatch triggers from check/zizmor
• add a GitHub STS policy granting only members: read for the four trusted workflows on main
• pin Slack secret-rotation STS access to its four expected workflow files on main

Finding

The PR preview gate trusted author_association, admitted COLLABORATOR, and checked the PR author rather than the actor who pushed the current SHA or reran the workflow. A non-org collaborator could therefore cause repository code to execute with preview deployment, fee-payer, Slack, and application secrets. preview_destroy, preview sweep requests, and production also reached secrets without validating the effective triggering actor.

Verification

All PR checks pass:

• Check / Verify
• Check / Test Unit
• Check / Test Workers
• Check / E2E
• zizmor
• Socket Security

Local supplemental checks: zizmor reported no findings; actionlint found no new warnings; the sibling github-sts policy parser suite passed 52/52.