Re-enable the Fern Check workflow

Move fern_check.yml back into .github/workflows so pull requests and
pushes to main validate the specs again. Pin actions/checkout to a
commit, drop persisted git credentials, declare read-only permissions,
cap the job at 15 minutes, and cancel superseded pull request runs.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Author: levindixon

.github/workflows-disabled/fern_check.yml .github/workflows/fern_check.yml.github/workflows-disabled/fern_check.yml renamed to .github/workflows/fern_check.yml

@@ -6,12 +6,23 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   run:
+    name: Fern Check
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Install pnpm
         uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0