ci: harden privileged workflow trust boundaries

.github/workflows/update-packages.yml

@@ -18,6 +18,14 @@ jobs:
     outputs:
       tag: ${{ steps.release.outputs.tag }}
     steps:
+      - name: Require the default branch for manual runs
+        if: github.event_name == 'workflow_dispatch'
+        run: |
+          if [[ "$GITHUB_REF" != "refs/heads/${{ github.event.repository.default_branch }}" ]]; then
+            echo "Manual package updates may only run from the default branch." >&2
+            exit 1
+          fi
+
       - name: Resolve published release tag
         id: release
         env:
@@ -60,7 +68,7 @@ jobs:
     env:
       RELEASE_TAG: ${{ needs.resolve-release.outputs.tag }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           ref: ${{ github.event.repository.default_branch }}
           fetch-depth: 0
@@ -95,7 +103,7 @@ jobs:
     needs: resolve-release
     runs-on: windows-latest
     steps:
-      - uses: vedantmgoyal9/winget-releaser@v2
+      - uses: vedantmgoyal9/winget-releaser@4ffc7888bffd451b357355dc214d43bb9f23917e # v2
         with:
           identifier: edde746.Plezy
           installers-regex: 'plezy-windows-installer\.exe$'
@@ -110,7 +118,9 @@ jobs:
     env:
       RELEASE_TAG: ${{ needs.resolve-release.outputs.tag }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          ref: ${{ github.event.repository.default_branch }}
 
       - name: Download appcast.xml from release
         run: |