chore(release): prepare ci-workflows 0.1.16

[rldyourmnd]

Summary

Prepare 0.1.16 so consumers can immutably pin the authenticated called-workflow fetch merged in #84. This closes the bootstrap failure reproduced three consecutive times by MyAttention's security bundle before any scanner ran.

Type of change

• New reusable workflow / capability
• Fix to an existing workflow
• Pinned tool/action version bump
• Hardening / security posture improvement
• Docs only

Threat-model note (required for workflow / permission changes)

No workflow behavior changes in this PR. The release contains #84: the existing contents: read job token is sent only to GitHub's HTTPS endpoint through repository-local http.extraheader; it is absent from argv and confined to the temporary source repository.

Permissions diff (required for workflow / permission changes)

No permissions diff: security-bundle remains contents: read.

Checklist

• All third-party actions pinned to a full 40-char commit SHA with a version comment.
• Least-privilege permissions unchanged.
• Existing concurrency and timeouts unchanged.
• Existing read-only checkouts keep persist-credentials: false.
• No expression interpolation was added to run:.
• No paid action or SARIF behavior changed.
• README/catalog changes are not required for a release-only commit.
• CHANGELOG updated.
• Commit is signed and signed off.

Tier impact

• Public (free OSS suite)
• Private free tier (zero-cost only)
• Private paid tier (GHAS / harden-runner features)