fix: resolve CodeQL code scanning alerts

- ci.yml: add top-level `permissions: contents: read` to restrict
  GITHUB_TOKEN to minimum required (fixes 3 missing-workflow-permissions alerts)
- claude-code-review.yml: remove unsafe `ref: pull_request.head.sha`
  checkout in pull_request_target workflow and pin checkout to SHA
  (fixes untrusted-checkout/high alert)
- tenor.ts: add codeql suppression comment for hard-coded-credentials;
  the fallback key is Google's public anonymous demo key, not a secret

.github/workflows/ci.yml

@@ -11,6 +11,9 @@ concurrency:
   group: ci-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   server-build-test:
     name: Server Build & Test

.github/workflows/claude-code-review.yml

@@ -27,10 +27,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-          fetch-depth: 1
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Run Claude Code Review
         id: claude-review