[jackharrhy]

Summary

• Add repository-owned workflow lint (jactionlint 2.3.0 and ShellCheck 0.11.0) and weekly Actions updates with a seven-day cooldown; group minor/patch releases.
• Pin actions to verified current release commits, limit job permissions, disable persisted checkout credentials, set timeouts and use non-cancelling publisher concurrency.
• Preserve main-only publication, image metadata and default Git build context. No application, lottery, balances, database, secrets or service configuration changes.

Verification

• Strict offline and online jactionlint 2.3.0 passed with ShellCheck 0.11.0 available.
• PyYAML BaseLoader comparison passed for every existing workflow: event gates, environment, run commands, ordering and Docker/image inputs match except the explicit hygiene/cache changes.
• git diff --check passed.

No publisher was dispatched and no production build was run locally. This is review-only: merging can publish an image followed by automatic deployment. Leave unmerged until reviewed; deployment/build success is not claimed by workflow lint.