Address the CodeRabbit review: inbound SMS, binary payloads and untrusted input

.github/workflows/release.yaml

@@ -13,6 +13,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@v5
         with:
           cache: npm

.github/workflows/test.yaml

@@ -5,11 +5,16 @@ on:
     branches: ['**']
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@v5
         with:
           cache: npm
@@ -27,6 +32,8 @@ jobs:
         node: ['18', '20', '22', '24']
     steps:
       - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@v5
         with:
           cache: npm