ci: test the event source before publish

[ryanduguid]

What changed

• remove the obsolete duplicate Node 18 workflow that used npm install
• keep one event-SHA build/test workflow using npm ci
• pin every third-party action in touched workflows to an immutable commit
• make the validation workflow token read-only and add a timeout
• explicitly check out ${{ github.sha }} for every publish-workflow job
• run build and tests as mandatory prerequisites for publishing that exact checkout
• commit the Octokit helper lockfile and install it with npm ci
• prevent fork workflow dispatches from entering publish/notification jobs
• reduce unused workflow permissions
• replace deprecated step output syntax
• correct the contribution guide's copied Maven command

Why

The repository ran two overlapping push workflows, the older one used mutable dependency resolution, and the release workflow could publish after a build without running tests. The contribution guide also instructed Node contributors to run Maven.

Validation

• actionlint on both retained workflows
• static assertions for immutable action pins, four explicit event-SHA checkouts and build/test/publish working-directory correlation
• clean Octokit npm ci and npm audit: 0 vulnerabilities
• clean npm ci
• npm run build
• npm test -- --runInBand — 16 tests passed
• git diff --check