ci: harden workflow execution (#1153)

Pin tool versions, restrict permissions and trusted triggers, and update
actions. Ensure preview releases validate the complete package set.

.github/workflows/build-keymap.yml

@@ -2,9 +2,13 @@ name: Build Keymap
 
 on:
   push:
+    branches: [main]
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 
@@ -25,7 +29,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          bun-version: 1.3.14
 
       - name: Setup Zig
         uses: mlugg/setup-zig@v2