ci: run the latest actions and toolchains, scope permissions per event, and generate the benchmark tables from one result

.changepacks/changepack_log_ci_hardening.json

@@ -0,0 +1,7 @@
+{
+    "changes":  {
+                    "bindings/devup-ui-wasm/package.json":  "Patch"
+                },
+    "note":  "CI and test infrastructure: the workflow always runs the latest releases (the ubuntu-latest runner, the newest major version of every action, and the latest stable Rust, Bun, Node.js, wasm-pack, cargo-binstall, cargo-tarpaulin and changepacks), runs pull requests read-only and moves npm publishing and Pages deployment into jobs that run only on pushes to main, never creates or commits e2e baselines, and sets timeouts. The wasm package build now starts from an empty pkg/ and verify:dist rejects files of the removed lite export, its README describes the real API, state and errors, and a Bun test checks the JS/WASM interface. The README benchmark tables are generated from one checked result file in both languages with the CSS size in its own column.",
+    "date":  "2026-10-01T00:00:00.000Z"
+}