CI workflow hardening: permissions block, SHA-pinned actions, concurrency group; SHA-pin gtest/Eigen #141

From the 2026-08-02 full-repo review (finding F-14, workflow-security part; the sanitizer job itself is tracked in #13).

Evidence (.github/workflows/build.yml): no permissions: block (default token grants write on push builds); actions/checkout@v4 is tag-pinned, not SHA-pinned; no concurrency: group (superseded PR runs keep running). In tests/CMakeLists.txt, googletest (GIT_TAG v1.14.0) and Eigen (GIT_TAG 3.4.0) ride movable tags while numsim-cas, numsim-materials, numsim-core, and CPM.cmake itself are SHA/SHA256-pinned — inconsistent with the repo's otherwise-strict reproducibility discipline.

Proposal (~10 lines total):

permissions:
  contents: read
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

plus actions/checkout@<full-sha> # v4.x.y, and commit-SHA pins for the gtest/Eigen fetches. Also worth adding: a weekly schedule: run to catch LLVM-apt/pin bit-rot between pushes.

Supporting evidence for #13's ASan job: the full suite already passes ASan+UBSan clean locally (gcc-14, -fno-sanitize-recover=all, 321/321 in ~11 s) — the leg costs one matrix row and starts green.