simplify-and-harden-ci

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The GitHub Actions setup reference github/gh-aw/actions/setup-cli@main (https://github.com/github/gh-aw) is fetched/installed at CI runtime to provide the gh-aw CLI—which executes remote code and enables agentic workflows that control prompts—making it a required runtime dependency.