Add `persist-credentials: false` to all 56 actions/checkout steps across
22 workflow files and the test-apps.cue template (regenerated test-apps.yml).
This prevents GITHUB_TOKEN from being stored in .git/config after checkout,
eliminating the primary vector used in supply chain attacks like the
tj-actions/changed-files incident.

sync-cue-actions.yml still performs a git push; it now injects credentials
via `git remote set-url` scoped only to that step rather than persisting
them for all subsequent steps.

Also add explicit `permissions:` blocks to 6 workflows that were inheriting
repo defaults, and fix two stale/missing version comments on checkout steps.

Add inline // vX.Y.Z comments to the three pinned action uses: lines in
test-apps.cue. The Makefile generation step now post-processes cue export
output with a Python one-liner that reads those comments and appends them
as # vX.Y.Z annotations in the generated YAML, matching the convention
used in all handwritten workflow files.

Extend sync-cue-actions.yml to also extract the version comment from
Dependabot's test-apps.yml update and sync it back into the test-apps.cue
comment, so the annotation stays correct after each Dependabot bump.

The previous sed used an address pattern /${action}@/ to scope the
substitution, but action names like actions/checkout contain literal
slashes that break both GNU and BSD sed's address parsing. Replace it
with an inline match in the substitute expression using | as delimiter,
which handles slashes in action names correctly.

Verified with a local Dependabot simulation: SHA and version comment
in test-apps.cue both update correctly after a Dependabot bump.