Disable checkout credential persistence so repository-controlled code
run by npm ci/test cannot read GITHUB_TOKEN from .git/config, and pin
actions to full commit SHAs to guard against mutable-tag supply-chain
attacks.
Run Perplexity search and auth requests through pi's Node runtime instead of
shelling out to Bun. Move development and CI commands to npm, add a Node test
build path, and keep OTP auth fail-fast when Set-Cookie headers are not
available.
Ivan Pereira