chore(ci): route package installs through Aegis

[decofe]

Motivation

Extend the Aegis rollout to all applicable workflows in this repository.

Solution

Initialize the same SHA-pinned secure runner as alloy#4203 before checkout and downloads, with job-scoped id-token: write. Review all 3 workflow files and 9 job definitions.

Run cargo-deny directly on the protected host instead of the reusable/container action, preserving all-features checks. Pin tool versions in the vendored installer and keep checksum verification enabled.

Validation and limits

YAML parsing, first-step/OIDC coverage assertions, and git diff --check passed. Actionlint reports no new diagnostics compared with the default branch. Full platform execution and live policy enforcement remain subject to GitHub CI.

The action configures Cargo, npm/pnpm/Yarn/Bun, Go, pip/uv/Poetry, and RubyGems/Bundler. Fork PRs without OIDC skip package enforcement with a warning. Cached artifacts, prebuilt tools, Docker images, OS packages, and direct binary downloads are not per-package policy checks. Existing dependency/lockfile policy is preserved.

Prepared with AI assistance.

Prompted by: @grandizzy

[codspeed]

Merging this PR will not alter performance

✅ 4 untouched benchmarks

---

_{Comparing centaur/secure-runner-1789725700 (5a9aa62) with main (861ba20)}

[mablr]

cargo-codspeed has no manifest in this pinned installer, so this always takes the cargo-binstall fallback https://github.com/tempoxyz/gh-actions/blob/25cce154e7fb10f99361a166468a6c56b9c31aa3/vendor/taiki-e/install-action/main.sh#L1093-L1107. checksum: true verifies the cargo-binstall bootstrap, but the fallback does not require a checksum/signature for the final tool binary. We should probably use an exact-version locked source install through Aegis, or add verified artifact support in gh-actions and disable fallback.