chore: GH Actions hardening — pin actions to SHA, add permissions and timeouts

[dielduarte]

Summary by cubic

Hardened GitHub Actions for resend-ruby: pinned actions/checkout and ruby/setup-ruby to commit SHAs, set top‑level permissions: contents: read, and added a 15‑minute timeout to the test job. Addresses Linear DEV-664 (1 HIGH, 1 MED, 1 LOW).

^{Written for commit ad5ae92. Summary will update on new commits.}

[cubic-dev-ai]

cubic analysis

No issues found across 1 file

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

Linked issue analysis

Linked issue: DEV-664: [resend-ruby] GH Actions hardening — 1 HIGH / 1 MED / 1 LOW

Status	Acceptance criteria	Notes
✅	Pin ruby/setup-ruby@v1 to a specific commit SHA (avoid floating tag)	The workflow now references ruby/setup-ruby with a commit SHA instead of the floating v1 tag.
✅	Add top-level permissions to the workflow	A top-level permissions block was added with contents: read.
✅	Add timeout-minutes to the test job in build.yml	The test job now sets timeout-minutes to limit runtime.

_{Auto-approved: This change hardens the GitHub Actions workflow by pinning actions to specific commit SHAs, restricting permissions to read-only, and adding a timeout, which significantly improves security with no risk to the codebase.}