[jackharrhy]

Summary

• Add repository-owned strict jactionlint 2.3.0 validation with ShellCheck; refresh action release commit pins and version comments.
• Bound job runtimes, restrict token permissions, disable checkout credential persistence, and serialize image publishing without cancelling an active publication.
• Schedule weekly Actions updates with a seven-day cooldown; group minor/patch updates and leave majors separate.

Preserves pnpm setup and all six existing install/check/build commands, PR triggers, main-only publishing, registry/image names and metadata-derived tags/labels. No application changes or added browser/container checks. There were no publisher caches to remove; no lint suppressions were added. The embedded jactionlint version needs explicit future maintenance (Dependabot does not update shell command versions).

Verification

• Strict online and offline jactionlint with ShellCheck 0.11.0: passed; baseline findings captured outside the repository.
• Project oxfmt check on all four changed YAML files and git diff --check: passed.
• YAML BaseLoader comparison: existing triggers, environments, job identities/gates, commands, action identities and deployment inputs preserved.
• Application checks run on GitHub-hosted CI; no local heavyweight build or Docker run.

Review only: do not merge as part of this maintenance. A future merge still triggers the existing main image publisher and may be picked up by deployment automation.