<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41198
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated GitHub Actions dependencies to latest stable versions across
CI/CD workflows for improved reliability, security, and performance.
* Enhanced build provenance attestation configuration for macOS, Linux,
and Windows builds.
* **Security**
* Strengthened workflow validation by removing override exception for
build artifact version mismatch rules, ensuring stricter security
compliance.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- misfeature — rule enabled, waived only for the 6 Windows shell: cmd
workflows (catches any future misuse elsewhere).
- excessive-permissions and artipacked — fixed and fully enforced
(removed from gate).
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41198
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Improved CI/CD security by disabling credential persistence across
many workflows.
* Tightened workflow permissions to least-privilege for selected build
and analysis jobs.
* Made runner hardening and credential handling explicit in several
deployment and test workflows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41198
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated security hardening tools across multiple GitHub Actions
workflows to the latest available version for enhanced CI/CD
infrastructure protection and resilience.
* Enabled additional security validation rules in workflow configuration
to strengthen infrastructure oversight and improve vulnerability
detection capabilities across build and deployment pipelines.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Upgraded security protections across build and deployment workflows
for enhanced runner environment hardening.
* Strengthened CI/CD infrastructure security measures throughout
automated processes.
* No direct user-facing changes.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
for #16954
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
<!-- Note that API documentation changes are now addressed by the
product design team. -->
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
Luke Heath