nan-devops: harden the base-image staleness workflow and protect main #148

Non-blocking items from the security review of helmcode/nan-devops#744 (daily base-image staleness workflow):

• base-image-staleness.yml installs pytest unpinned (pip install pytest) in a job holding a contents: write GITHUB_TOKEN: pin with hashes, or run the tests in a job without write permissions.
• main in nan-devops has no branch protection/ruleset, and the default workflow token can approve PRs (can_approve_pull_request_reviews: true): protect main and disable that setting.
• The bot force-pushes auto/base-image-<component>: document that manual commits there are overwritten.
• build-agent-base-image.yml interpolates ${{ github.event.inputs.version }} directly in a run: step (Derive version): pass it through env.

🤖 Generated with Claude Code