harden testing workflows (env-var policy + permissions + SHA-pin) #4650

Job	Run time
check-fork-status	3s
test-local (latest_official, dremio) / test	19m 51s
test-local (latest_official, sqlserver) / test	19m 50s
test-local (latest_pre, postgres) / test	13m 33s
test-local (latest_official, trino) / test	19m 51s
test-local (latest_official, spark) / test	19m 49s
test-local (latest_official, postgres) / test	18m 59s
test-local (latest_official, vertica) / test	10m 55s
test-local (latest_official, duckdb) / test	19m 25s
test-local (latest_official, clickhouse) / test	10m 30s
approve-fork	0s
test-cloud (fusion, bigquery) / test	52s
test-cloud (latest_official, bigquery) / test	57s
test-cloud (latest_official, snowflake) / test	41s
test-cloud (latest_official, athena) / test	55s
test-cloud (latest_official, databricks_catalog) / test	45s
test-cloud (fusion, snowflake) / test	42s
test-cloud (fusion, databricks_catalog) / test	41s
test-cloud (latest_official, redshift) / test	34s
test-cloud (latest_official, fabric) / test	49s
	2h 39m 42s

Provide feedback