Address code review comments on compile-workflows.yaml and code-review.md

Co-authored-by: imjasonh <210737+imjasonh@users.noreply.github.com>

.github/workflows/code-review.md

@@ -30,6 +30,7 @@ safe-outputs:
 
 tools:
   github:
+    lockdown: true
     toolsets: [pull_requests, repos]
   bash: true
   web-fetch:

.github/workflows/compile-workflows.yaml

@@ -14,23 +14,28 @@ jobs:
   compile:
     name: Compile
     runs-on: ubuntu-latest
+    # Skip fork PRs: secrets are unavailable, and we should not compile
+    # untrusted .md content from a fork and push it back.
+    if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false)
+    permissions:
+      contents: read  # checkout; push uses GH_PAT explicitly
 
     steps:
       - name: Checkout (push)
         if: github.event_name == 'push'
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           token: ${{ secrets.GH_PAT }}
 
       - name: Checkout (PR head branch)
         if: github.event_name == 'pull_request'
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           ref: ${{ github.head_ref }}
           token: ${{ secrets.GH_PAT }}
 
       - name: Install gh-aw extension
-        run: gh extension install github/gh-aw
+        run: gh extension install github/gh-aw --version v0.50.7
         env:
           GH_TOKEN: ${{ secrets.GH_PAT }}