fix(security): close remaining scan alerts

[StringKe]

Summary

• keep the Release workflow read-only by default and grant contents: write only to the release job
• update event-listener in the Linux SDK lockfile from 5.4.1 to 5.4.2
• remove the now-unused concurrent-queue and crossbeam-utils lock entries

Security context

• resolves Scorecard TokenPermissionsID alert feat(site): launch localized product landing #43
• removes RUSTSEC-2026-0221 from the Linux SDK dependency graph
• the remaining image-size findings in Scorecard alert chore(deps): Bump the nuget group with 4 updates #3 are already remediated by patches/image-size@1.2.1.patch; Scorecard matches registry versions and cannot identify the backport
• Scorecard MaintainedID alert chore(deps): bump the cargo group across 2 directories with 15 updates #5 is an immutable repository-age signal and will age out after 90 days

Verification

• cargo audit --file sdk/linux/Cargo.lock: 0 vulnerabilities, 0 warnings
• pnpm audit --prod --audit-level high: no known vulnerabilities
• pnpm run test:release-contracts: 60 tests PASS
• pnpm run check: PASS
• pnpm test: PASS
• git diff --check: PASS