Add Socket Firewall to CI

[peakematt]

Dependency installs in the test workflow currently reach the public npm registry directly. This change routes both install sites through Socket Firewall while keeping the existing build and test commands unchanged.

The workflow now uses read-only permissions, disables persisted checkout credentials, and enables the validated external-fork fallback only for this low-privilege pull request workflow. The Socket Firewall step uses the public repository token and is placed after the runner setup steps, before npm ci, so mise and Postgres setup keep their current behavior.

Verify by running git diff --check and npm run build. The pull request checks should also show Lint and build and each Postgres test job passing with Socket Firewall active.

Tested locally with git diff --check, workflow assertions, actionlint, npm ci --ignore-scripts, npm run build, npm run typecheck, and npm run format:check.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge with no actionable correctness, security, or repository-rule violations identified.

Summary

• Grants only read access to repository contents.
• Prevents checkout credentials from persisting.
• Adds the SHA-pinned Socket Firewall setup before both npm ci sites.
• Preserves external-fork CI through the low-privilege fallback.