Merge branch 'chore/cicd-optimizations'

# Conflicts:
#	.github/workflows/boj-build.yml
#	Cargo.lock

Author: hyperpolymath

.claude/CLAUDE.md

@@ -7,7 +7,7 @@ Cross-platform document editor with format tabs, allowing users to view and edit
 ## Architecture
 
 - **Core**: Rust library with unified AST for format conversion
-- **GUI**: Tauri 2.0 with ReScript frontend (not TypeScript!)
+- **GUI**: Gossamer (own webview shell) with ReScript frontend (not TypeScript!)
 - **TUI**: Ada with AdaCurses (matches git-hud pattern)
 - **Storage**: ArangoDB for graph + document hybrid
 - **Pipelines**: Nickel for import/export transformations
@@ -28,13 +28,14 @@ Cross-platform document editor with format tabs, allowing users to view and edit
 - Go (use Rust)
 - Python (not applicable here)
 - Makefiles (use justfile)
+- Tauri (use Gossamer)
 
 ## Key Directories
 
 ```
 crates/
 ├── formatrix-core/    # AST, parsers, renderers
-├── formatrix-gui/     # Tauri commands
+├── formatrix-gui/     # Gossamer commands
 ├── formatrix-db/      # ArangoDB client
 └── formatrix-pipeline/ # Nickel executor
 

.github/workflows/boj-build.yml

@@ -9,10 +9,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - name: Trigger BoJ Server (Casket/ssg-mcp)
         run: |
           # Send a secure trigger to boj-server to build this repository
           curl -X POST "http://boj-server.local:7700/cartridges/ssg-mcp/invoke"             -H "Content-Type: application/json"             -d "{\"repo\": \"${{ github.repository }}\", \"branch\": \"${{ github.ref_name }}\", \"engine\": \"casket\\"}"}
         continue-on-error: true
-permissions: read-all
+permissions:
+  contents: read

.github/workflows/cflite_batch.yml

@@ -3,7 +3,8 @@ name: ClusterFuzzLite Batch
 on:
   schedule:
     - cron: '0 0 * * 0'
-permissions: read-all
+permissions:
+  contents: read
 jobs:
   BatchFuzzing:
     runs-on: ubuntu-latest

.github/workflows/cflite_pr.yml

@@ -4,7 +4,8 @@ on:
   pull_request:
     paths:
       - '**/*.rs'
-permissions: read-all
+permissions:
+  contents: read
 jobs:
   PR:
     runs-on: ubuntu-latest

.github/workflows/codeql.yml

@@ -9,7 +9,8 @@ on:
   schedule:
     - cron: '0 6 * * 1'
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   analyze:

.github/workflows/guix-nix-policy.yml

@@ -2,7 +2,8 @@
 name: Guix/Nix Package Policy
 on: [push, pull_request]
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   check:

.github/workflows/hypatia-scan.yml

@@ -11,7 +11,8 @@ on:
     - cron: '0 0 * * 0'  # Weekly on Sunday
   workflow_dispatch:
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   scan:

.github/workflows/mirror.yml

@@ -7,7 +7,8 @@ on:
     branches: [main]
   workflow_dispatch:
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   mirror-gitlab:

.github/workflows/npm-bun-blocker.yml

@@ -2,7 +2,8 @@
 name: NPM/Bun Blocker
 on: [push, pull_request]
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   check:

.github/workflows/quality.yml

@@ -3,7 +3,8 @@ name: Code Quality
 on: [push, pull_request]
 
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   lint: