harden testing workflows (env-var policy + permissions + SHA-pin) #4660

Job	Run time
check-fork-status	2s
test-local (latest_official, spark) / test	29m 20s
test-local (latest_official, dremio) / test	33m 46s
test-local (latest_official, duckdb) / test	18m 54s
test-local (latest_pre, postgres) / test	16m 59s
test-local (latest_official, sqlserver) / test	21m 1s
test-local (latest_official, trino) / test	30m 10s
test-local (latest_official, postgres) / test	18m 46s
test-local (latest_official, clickhouse) / test	10m 59s
test-local (latest_official, vertica) / test	10m 5s
test-cloud (latest_official, databricks_catalog) / test	47s
test-cloud (fusion, bigquery) / test	59s
test-cloud (latest_official, athena) / test	49s
test-cloud (latest_official, fabric) / test	56s
test-cloud (latest_official, redshift) / test	37s
test-cloud (latest_official, snowflake) / test	36s
test-cloud (fusion, snowflake) / test	34s
test-cloud (fusion, databricks_catalog) / test	41s
test-cloud (latest_official, bigquery) / test	56s
approve-fork	0s
	3h 16m 57s

Provide feedback