[huangjeff5]

Stacked on #621 (which sits on #620). Moves the Python workflow hardening out of #620 so that PR only carries the Handlebars package.

Only .github/workflows/python.yml changes:

• Every uses: is pinned to a commit SHA, with the tag in a trailing comment.
• The workflow token defaults to contents: read. uv-lock-check keeps its job-level contents: write and pull-requests: write.
• persist-credentials: false on the check-paths and python-checks checkouts.
• tj-actions/changed-files moves from v45 to v47.0.6.

Decisions

• Pin to SHAs, not tags: Tags are mutable. The March 2025 tj-actions/changed-files compromise retargeted existing tags to a commit that dumped CI secrets into logs. A SHA pin runs exactly the code that was reviewed.
• Read-only by default, write where a job pushes: Previously, every job got the repo's default token scope. Only uv-lock-check writes, so it is the only job that asks for write.
• uv-lock-check keeps its checkout credentials: That job runs git push to commit regenerated lockfiles back to release-please--* branches. persist-credentials: false there removes the token from the checkout and that push fails. The version of this change that was in feat(py)!: replace Rust handlebarrz with pure-Python dotpromptz-handlebars #620 had that bug.

[huangjeff5]

Absorbed into #620 so that all Python CI workflow hardening and SHA pinning land directly with the Handlebars package changes, resolving the GitHub Actions Scan findings.