GeezerVison

Fixes what the linters in lint-workflows.yml report. I ran each one locally the way CI runs it: actionlint 1.7.12 with shellcheck, octoscan through the action's own entrypoint.sh with the same inputs, poutine 1.1.4, and zizmor 1.31.1 with --persona=auditor.

What changed

• Credentials: checkouts set persist-credentials: false, except in create-tag.yml. There, rickstaa/action-create-tag pushes the tag with the persisted PHPSTAN_BOT_TOKEN, and only a tag pushed by that token, not by GITHUB_TOKEN, triggers release.yml. This is now explicit and commented. Every other step that writes uses its own token through the API or an input.
• Permissions: every workflow defaults to permissions: {}, and each job is granted what it uses, with a comment. The default token was already read-only (contents, metadata, packages: read), so in practice only the unused packages: read is dropped.
• Concurrency: in PR and push workflows, a new push to a pull request cancels that PR's previous run. Each push to 2.4.x still gets its own run. Release workflows (tags, releases, dispatch, schedule, merge of 1.22.x) queue new runs with cancel-in-progress: false instead of cancelling.
• Template injection: matrix.branch in apiref.yml and github.ref_name in send-pr.yml reach the shell through env.
• Job names: added to the jobs that had none. No required status checks depend on job names.
• Release: softprops/action-gh-release is replaced by gh release create "$TAG" --verify-tag --title "$TAG" --notes "$CHANGELOG", using the same bot token. peter-evans/create-pull-request stays, because it commits, pushes a branch and opens the PR in one step. Its zizmor superfluous-actions finding is ignored inline.
• actionlint download: a pinned release tarball whose checksum is verified, instead of bash <(curl …/main/…).

Suppressions (please review)

• .github/poutine.yml skips github_action_from_unverified_creator_used for an explicit list of the pinned actions we use, such as setup-php, lock-threads, and the release/tag actions.
• .github/zizmor.yml allows the repository secrets used outside environments (secrets-outside-env). Fixing this properly means moving the secrets into dedicated environments in the repository settings first.
• octoscan's dangerous-checkout flags every ref that isn't made of letters and dashes only, so 2.3.x, 2.x, a pinned SHA and matrix.branch all count. octoscan can only ignore findings by message, not by file, so this message is now ignored globally. zizmor and poutine still check for checkouts of untrusted code.

The release workflows (release, send-pr, create-tag, toot/tweet) can't run from a PR, so the release changes are verified only by reading the actions' sources.