fix(ci): address review findings

.github/actions/install-node-dependencies/action.yml

@@ -57,9 +57,6 @@ runs:
         pnpm install \
           --no-frozen-lockfile \
           --prefer-frozen-lockfile=false \
-          --os=current \
-          --os=win32 \
-          --cpu=current \
           --ignore-scripts
         git diff --exit-code package.json pnpm-lock.yaml
 

.github/workflows/pr.yml

@@ -12,6 +12,9 @@ concurrency:
   group: pr-checks-${{ github.event.pull_request.number }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   static_analysis:
     name: static analysis